DOE G 450.4-1A, Vol 1, Integrated Safety Management System Guide (Volume 1), Chapter IV - Approved on March 28, 2000 and Added to the Guide

DOE G 450.4-1A May 27, 1999 Volume 1 of 2 INTEGRATED SAFETY MANAGEMENT SYSTEM GUIDE for use with SAFETY MANAGEMENT SYSTEM POLICIES (DOE P 450.4, DOE P 450.5, AND DOE P 450.6); THE FUNCTIONS, RESPONSIBILITIES, AND AUTHORITIES MANUAL; AND THE DEPARTMENT OF ENERGY ACQUISITION REGULATION Volume One: Guidance Assistant Secretary for Environment, Safety and Health CANCELE D Page ii - Integrated Safety Management System Guide - Volume 1 5-27-99 This page intentionally left blank. CANCELE D Volume 1 - Integrated Safety Management System Guide - Page iii Foreword 5-27-99 DOE G 450.4-1A FOREWORD This Department of Energy (DOE) Integrated Safety Management System (ISMS) Guide is approved for use by the Office of Environment, Safety and Health (EH) and is available for use by all DOE components and their contractors. This Guide is a consensus document coordinated by EH and prepared under the direction of the DOE Safety Management Implementation Team (SMIT). This revision addresses feedback received as a result of the 6-month trial implementation period following the release and use of Revision 0. Although revisions have been made throughout the document, Chapter III, ISMS Development, Implementation, Review, and Approval, and Appendix E, ISMS Evaluation Guidance, have been substantially revised based on experience and feedback. Additionally, Section, I.3, Tailoring the ISMS, and Appendix C have been removed. This Guide provides guidance for addressing the requirements of the following: • DOE P 450.4, SAFETY MANAGEMENT SYSTEM POLICY; • DOE P 450.5, LINE ENVIRONMENT, SAFETY AND HEALTH OVERSIGHT; • DOE P 450.6, SECRETARIAL POLICY STATEMENT, ENVIRONMENT, SAFETY AND HEALTH; • DOE P 411.1, SAFETY MANAGEMENT FUNCTIONS, RESPONSIBILITIES, AND AUTHORITIES POLICY; and • Department of Energy Acquisition Regulation (DEAR) clauses promulgated in 48 Code of Federal Regulations (CFR) 970.5204-2, 48 CFR 970.5204-78, and 48 CFR 970.1001. Attachments 1 through 5 to Volume 1 contain the full text of these Policies and the relevant Safety Management System (SMS) sections of the DEAR. Volume 1 of this Guide addresses the following topics: • Introduction; • Chapter I, SMS Integration and Products; • Chapter II, ISMS Core Functions and Principles; and • Chapter III, ISMS Development, Implementation, Review, and Approval. CANCELE D Page iv - Integrated Safety Management System Guide - Volume 1 5-27-99 Foreword DOE G 450.4-1A Volume 2 of the Guide includes the following appendixes: • Appendix A: Glossary; • Appendix B: Resources for Complying with the SMS Policies, the FRAM, and the DEAR; • Appendix C: Development, Implementation, and Evaluation Guidance for an ISMS at a Hazard Category 2 Nuclear Facility; • Appendix D: Discussion of Safety Management Assessment; and • Appendix E: ISMS Evaluation Guidance. Information on Integrated Safety Management (ISM) can be found on the Safety Management Home Page (http://tis-nt.eh.doe.gov/ism), which includes this Guide, Policies relevant to the SMS, the Level 1 and lower-tier Functions, Responsibilities, and Authorities Manuals (FRAMs), and relevant parts of the DEAR. Questions concerning the SMS Policy should be directed to Mr. Richard C. Crowe, Director, Safety Management Implementation Team, at 301-903-6214. Questions concerning administration or content of this Guide should be directed to Mr. Richard Stark, EH, at 301-903-4407. CANCELE D http://tis-nt.eh.doe.gov/ism

Volume 1 - Integrated Safety Management System Guide - Page v Contents 5-27-99 DOE G 450.4-1A CONTENTS FOREWORD . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . iii INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 CHAPTER I, SMS INTEGRATION AND PRODUCTS . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 1. GENERAL ASPECTS OF INTEGRATION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 1.1 SMS Integration by Site, Facility, and Activity . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 1.2 Integration of DOE and Contractor Roles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 1.3 Integration of Safety and Business Processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 1.4 Integration by Type of Risk and Hazard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 1.4.1 Integration of Risk (Worker, Public, and the Environment) . . . . . . . . . . . 11 1.4.2 Hazard Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 1.4.3 Integration Responsibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 1.5 Integration by Phase of Facility Life Cycle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 2. ISMS DEVELOPMENT AND IMPLEMENTATION PROCESSES AND PRODUCTS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 2.1 Develop and Document the ISMS in Accordance with Requirements in the DEAR . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 2.2 Review and Approve the ISMS as Required by the DEAR and in Accordance with DOE Responsibilities in the FRAM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 2.3 Evaluate the ISMS Implementation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 2.4 Monitoring and Annual Update of ISMS in Accordance with Requirements in the DEAR . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 3. TAILORING THE ISMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 CHAPTER II, ISMS CORE FUNCTIONS AND GUIDING PRINCIPLES . . . . . . . . . . . . . 19 1. GUIDING PRINCIPLES 1, 2, AND 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 1.1 DOE Responsibilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 1.2 Contractor Responsibilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 2. CORE FUNCTION 1, DEFINE SCOPE OF WORK, AND GUIDING PRINCIPLE 4, BALANCED PRIORITIES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 2.1 Describing the Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 2.2 Determining the Level of Detail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 CANCELE D Page vi - Integrated Safety Management System Guide - Volume 1 5-27-99 Contents DOE G 450.4-1A CONTENTS (continued)

2.3 Establishing Expectations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 2.4 Worker Participation in Work Planning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 2.5 Providing for Integration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 2.6 Establishing Priorities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 3. CORE FUNCTION 2, ANALYZE HAZARDS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 4. CORE FUNCTION 3, DEVELOP/IMPLEMENT CONTROLS; GUIDING PRINCIPLE 5, IDENTIFICATION OF SAFETY STANDARDS AND REQUIREMENTS; AND GUIDING PRINCIPLE 6, HAZARD CONTROLS TAILORED TO WORK BEING PERFORMED . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 4.1 Identification of Appropriate Standards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 4.2 Sitewide Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 4.3 Facility-Specific Requirements [Identification of Appropriate Controls] . . . . . . . 39 4.4 Worker Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 5. CORE FUNCTION 4, PERFORM WORK, AND GUIDING PRINCIPLE 7, OPERATIONS AUTHORIZATION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 5.1 Authorizing Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 5.1.1 Authorization Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 5.1.2 Authorization Agreement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 5.2 Sample Format and Content for Authorization Agreements . . . . . . . . . . . . . . . . . 47 6. CORE FUNCTION 5, FEEDBACK/ IMPROVEMENT . . . . . . . . . . . . . . . . . . . . . . . . 49 CHAPTER III, ISMS DEVELOPMENT, IMPLEMENTATION, REVIEW, AND APPROVAL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 1. BACKGROUND . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 2. DEVELOPMENT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 2.1 DOE Development . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 2.1.1 Core Function 1, Define Scope of Work . . . . . . . . . . . . . . . . . . . . . . . . . . 54 2.2 Contractor Actions to Develop an ISMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 2.2.1 Evaluation of Existing Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 2.2.2 Gap Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 CANCELE D Volume 1 - Integrated Safety Management System Guide - Page vii Contents 5-27-99 DOE G 450.4-1A CONTENTS (continued) 3. IMPLEMENTATION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 3.1 DOE Actions Required to Support Implementation of ISMS . . . . . . . . . . . . . . . . 58

3.1.1 Core Function 2, Analyze Hazards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 3.1.2 Core Function 3, Develop/Implement Hazard Controls . . . . . . . . . . . . . . 59 3.1.3 Core Function 4, Perform Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 3.1.4 Core Function 5, Feedback and Improvement . . . . . . . . . . . . . . . . . . . . . . 61 3.2 Contractor Actions to Implement ISMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 3.2.1 Preparing ISMS Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 3.2.2 Additional Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 3.2.3 ISMS Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 4. EXPECTATION AND ATTRIBUTES OF ISMS DOCUMENTATION . . . . . . . . . . . 64 4.1 Expectations for Core Function 1, Define Scope of Work, and Guiding Principle 4, Balanced Priorities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 4.1.1 Translate Mission into Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 4.1.2 Set Expectations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66 4.1.3 Provide for Integration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66 4.1.4 Prioritize Tasks and Allocate Resources . . . . . . . . . . . . . . . . . . . . . . . . . . 67 4.2 Expectations for Core Function 2, Analyze Hazards . . . . . . . . . . . . . . . . . . . . . . . 68 4.2.1 Identify Hazards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 4.2.2 Analyze Hazards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69 4.2.3 Categorize Hazards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69 4.3 Expectations for Core Function 3, Develop/Implement Hazard Controls; Guiding Principle 5, Identification of Safety Standards and Requirements; and Guiding Principle 6, Hazard Controls Tailored to Work Being Performed . . . . . 69 4.3.1 Identify Standards and Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 4.3.2 Identify Controls to Prevent/Mitigate Hazards . . . . . . . . . . . . . . . . . . . . . 70 4.3.3 Establish Safety Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 4.3.4 Implement Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 4.4 Expectations for Core Function 4, Perform Work, and Guiding Principle 7, Operations Authorization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 4.4.1 Confirm Readiness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 4.4.2 Operations Authorization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73 4.4.3 Perform Work Safely . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73 4.4.4 Performance Measures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 4.5 Expectations for Core Function 5, Feedback and Improvement . . . . . . . . . . . . . . 74 4.5.1 Collect Feedback Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 4.5.2 Identify Improvement Opportunities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75

CANCELE D Page viii - Integrated Safety Management System Guide - Volume 1 5-27-99 Contents DOE G 450.4-1A CONTENTS (continued) 4.5.3 Make Changes to Improve . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76 4.5.4 Oversight and Enforcement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76 4.6 Expectations for Guiding Principle 1, Line Management Responsibility for Safety, and Guiding Principle 2, Clear Roles and Responsibilities . . . . . . . . . . . . 76 4.7 Expectations for Guiding Principle 3, Competence Commensurate with Responsibility77 5. OVERSIGHT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 5.1 Oversight and Enforcement (FRAM 9.6.3) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 5.2 Contractor Implementation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 ATTACHMENT 1, DOE P 450.4, SAFETY MANAGEMENT SYSTEM POLICY . . . . . . . . . 83 ATTACHMENT 2, DOE P 450.5, LINE ENVIRONMENT, SAFETY AND HEALTH OVERSIGHT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 ATTACHMENT 3, DOE P 450.6, SECRETARIAL POLICY STATEMENT, ENVIRONMENT, SAFETY AND HEALTH . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 ATTACHMENT 4, DOE P 411.1, SAFETY MANAGEMENT FUNCTIONS, RESPONSIBILITIES, AND AUTHORITIES POLICY . . . . . . . . . . . . . . . . . . . . . . . . . . 93 ATTACHMENT 5, DEAR CLAUSES RELATED TO ISMS . . . . . . . . . . . . . . . . . . . . . . . . . . 95 CANCELE D Volume 1 - Integrated Safety Management System Guide - Page ix Contents 3-28-00 DOE G 450.4-1A CONTENTS (continued) CHAPTER IV, MAINTAINING AN APPROVED ISMS 1. OVERVIEW . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 2. CONTRACTOR ANNUAL AND CONTINUOUS ACTIVITIES . . . . . . . . . . . . . . . . . . . . 2 3. DOE ANNUAL AND CONTINUOUS ACTIVITIES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 4. ADDITIONAL CONSIDERATIONS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 4.1 Detailed Discussion of Contractor Activities for Updating and Maintaining the ISMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 4.1.1 Post Verification Activities-verification Follow-up /Actions Identified in Previous Annual ISMS Update Reports . . . . . . . . . . . . . . . . . . . . 4 4.1.2 Contractor Activities to Sustain, Measure, and Update a Satisfactory ISMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 4.1.3 Introduction of a Major New Facility or Major Mission Change Within an Existing Facility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 4.1.4 Changes to Laws Regulations and Directives . . . . . . . . . . . . . . . . . . . . . . . . . . 7 4.2 Detailed Discussion of DOE Required Activities Related to ISMS Continual Evaluation and the Annual Updating of ISMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 4.3 Considerations for Performing Another Phase I or II Verification . . . . . . . . . . . . . . . . . . . 9 4.3.1 Loss of Confidence in the Adequacy of the Existing ISMS . . . . . . . . . . . . . . . . 9 4.3.2 Change of Contractor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

4.4 Aids for Conducting Annual Reviews of an ISMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 4.5 DOE Requirements for Sustaining ISMS and Conducting Annual Reviews/Approvals . . 13 4.5.1 Assessment/self-assessment of DOE’s Performance . . . . . . . . . . . . . . . . . . . . 14 4.5.2 DOE Oversight of a Contractor’s Integrated Safety Management Implementation and Performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 CANCELE D Volume 1 - Integrated Safety Management System Guide - Page 1 Introduction 5-27-99 DOE G 450.4-1A INTRODUCTION PURPOSE. This Guide has two purposes. One purpose is to assist Department of Energy (DOE) contractors in developing, describing, and implementing an Integrated Safety Management System (ISMS) in compliance with DOE P 450.4, SAFETY MANAGEMENT SYSTEM POLICY (the SMS Policy); DOE P 450.5, LINE ENVIRONMENT, SAFETY AND HEALTH OVERSIGHT; DOE P 450.6, SECRETARIAL POLICY STATEMENT ENVIRONMENT, SAFETY AND HEALTH; DOE P 411.1, SAFETY MANAGEMENT FUNCTIONS, RESPONSIBILITIES, AND AUTHORITIES (FRAM); and the following provisions of the Department of Energy Acquisition Regulation (DEAR): • 48 Code of Federal Regulations (CFR) 970.5204-2, which requires integration of environment, safety, and health into work planning and execution; • 48 CFR 970.5204-78, which deals with laws, regulations, and DOE directives; and • 48 CFR 970.1001, which requires performance-based contracting. Attachments 1 through 5 to Volume 1 contain the full text of the Policies and the relevant ISMS sections of the DEAR. A second purpose of this Guide is to assist DOE line managers and contracting officers (COs) who– • provide ISMS guidance and requirements, • review and approve ISMS products, • verify implementation of the ISMS, and • perform various integrating activities (e.g., planning, budgeting, review, approval, and oversight) that complement or are required for the ISMS. DOE responsibilities for these activities are described in the three ISMS-related DEAR clauses listed above, DOE M 411.1-1A (the FRAM), and the lower-tier Functions, Responsibilities, and Authorities (FRA) documents. This Guide does not override, alter, or minimize the requirements of the SMS Policies, the DEAR, the FRAM, or other DOE regulations and requirements. It is not a prescriptive document but instead offers flexible guidance that complies with the requirements of the Policies, the law, and the FRAM. Other practices that meet the intent of this Guide and comply with the requirements may be used. CANCELE D Page 2 - Integrated Safety Management System Guide - Volume 1 5/27/99 Introduction DOE G 450.4-1A ISMS OBJECTIVE. The objective of an ISMS is to incorporate safety into management and work practices at all levels, addressing all types of work and all types of hazards to ensure safety for the workers, the public, and the environment. To achieve this objective, DOE has established guiding principles and core safety management functions. The objectives, principles, and functions are set forth in the attached Policies and DEAR clauses and are discussed in detail in this Guide. An effective ISMS must address these principles and functions while considering the following: • the planning and performance of all types of potentially hazardous work, including but not limited to the following: construction, operations, maintenance and decommissioning, as well as design, conceptual studies, environmental analyses, safety analyses, hazard reduction analyses, pollution prevention/waste minimization and risk analyses;

• all types of hazards, including chemical, occupational, environmental, nuclear, electrical, transportation, etc.; and • the identification, analysis, and control of hazards, and the use of feedback for continuous improvement in defining, planning, and performing work. In the SMS Policy and this Guide, the term “safety” is used to encompass environment, safety, and health. Management and workers should understand that safety is an integral part of each work activity. Accordingly, safety should be a prime consideration in the work practices of all personnel, including line management at the field office, corporate, and division levels, and program personnel at all management and working levels. ISMS PROCESS AND PRODUCTS. The three DEAR clauses specify the following processes and products in developing and implementing an ISMS, including the following: • The contractor develops and documents an ISMS in accordance with the requirements in the DEAR (48 CFR 970.5204-2) and guidance provided by the contracting officer (CO). The ISMS description allows DOE and the contractor to agree upon a framework for safety management of contracted work. • DOE reviews and approves ISMS documentation in accordance with the DEAR [48 CFR 970-5204-2(e)] and the responsibilities specified in the FRAM. • DOE evaluates satisfactory ISMS implementation in accordance with the FRAM (Section 9.5.2). • On an annual basis, the contractor reviews and updates for DOE approval its safety performance objectives, performance measures, and commitments, consistent and in response to DOE’s program and budget execution guidance and direction [48 CFR 970.5204.2(e)]. CANCELE D Volume 1 - Integrated Safety Management System Guide - Page 3 Introduction 5-27-99 DOE G 450.4-1A In addition, the FRAM requires DOE to perform numerous ISM actions such as– • monitoring the proper implementation of controls (Section 9.4.4), and • performing assessments of their own organizations to identify areas in which continuous improvements in the safety of DOE operations can be realized (Section 9.6.1.4). APPLICABILITY. This Guide applies to the activities required of DOE line managers and contracting officials (referred to as contracting officers, heads of contracting authorities, or field element managers) in fulfilling their responsibilities, as specified in the ISMS Policies, the DEAR, and the FRAM. This Guide also applies to the activities required of DOE contractors in fulfilling their responsibilities, as specified in the Policies and in the DEAR. CANCELE D Page 4 - Integrated Safety Management System Guide - Volume 1 5/27/99 Introduction DOE G 450.4-1A This page intentionally left blank. CANCELE D Volume 1 - Integrated Safety Management System Guide - Page 5 Chapter I 5-27-99 1 DOE P 450.4, SAFETY MANAGEMENT SYSTEM POLICY, is contained in Attachment 1. 2 Attachment 5 contains the applicable clauses of the DEAR, 48 CFR Chapter 9. 3 DOE P 411.1, SAFETY MANAGEMENT FUNCTIONS, RESPONSIBILITIES, AND AUTHORITIES POLICY, is provided in Attachment 4. DOE G 450.4-1A CHAPTER I SMS INTEGRATION AND PRODUCTS

DOE is responsible for ensuring that work performed at its sites is conducted efficiently and in a manner that ensures protection of workers, the public, and the environment. To formalize this responsibility, DOE issued DOE P 450.4, SAFETY MANAGEMENT SYSTEM POLICY,1 on October 15, 1996. The SMS Policy specifies a formal, organized process based on key guiding principles and core functions for ensuring the integration of safety, health, and environmental considerations into all types of work, at all DOE sites and facilities, for all types of potential hazards. As a result of the SMS Policy, DOE subsequently issued the related Department of Energy Acquisition Regulation (48 CFR Chapter 9, the DEAR),2 on June 27, 1997, which, with regard to integration, requires the following: • . . . The contractor shall ensure that management of environment, safety and health (ES&H) functions and activities becomes an integral but visible part of the contractor’s work planning and execution processes. . . . [48 CFR 970.5204-2(b)] • . . . the System shall be integrated with the contractor’s business processes for work planning, budgeting, authorization, execution, and change control. [48 CFR 970.5204-2 (e)] DOE also issued DOE P 411.1, SAFETY MANAGEMENT FUNCTIONS, RESPONSIBILITIES, AND AUTHORITIES POLICY, on January 28, 1997, and DOE M 411.1-1A, MANUAL OF SAFETY MANAGEMENT FUNCTIONS, RESPONSIBILITIES, AND AUTHORITIES (the FRAM)3 on [date to be determined]. Additionally, DOE P 450.5, LINE ENVIRONMENT, SAFETY AND HEALTH OVERSIGHT, and DOE P 450.6, SECRETARIAL POLICY STATEMENT ENVIRONMENT, SAFETY AND HEALTH, were issued to emphasize certain aspects of ISMS. The DEAR describes ISMS responsibilities for both DOE and contractors, while the FRAM (both the Headquarters Level 1 FRAM and the lower-tier directives specifying functions, responsibilities, and authorities, known as “FRAs”) describes responsibilities and authorities for DOE only. CANCELE D Page 6 - Integrated Safety Management System Guide - Volume 1 5-27-99 Chapter I DOE G 450.4-1A Section 1 of this chapter discusses the general nature of integration and Section 2 discusses the processes and products associated with the development and implementation of an ISMS. Section 3 of this chapter discusses the concept of tailoring an ISMS. 1. GENERAL ASPECTS OF INTEGRATION In general, the development and implementation of an ISMS requires an organization to integrate safety into all aspects of work planning and execution, using the guiding safety principles and core functions set forth in the SMS Policy. Integration means that all management systems and programs are designed to fit together to permit safe and efficient performance of work. Safety should be incorporated as a value into all business and operations systems. Integration is especially important for programs and activities with conflicting or competing goals or requirements (e.g., fire protection and criticality safety, or personnel safety and safeguards and security). Therefore, to achieve an ISMS that satisfies the DEAR, organizations should document the ISMS policies, programs, procedures, and manuals they plan to use. They should then submit their plan for DOE review and approval before finally implementing it. These processes will generate a number of documents, products, and actions that can be used to track and record the progress and success of the ISMS, as discussed in Section 2 of this chapter.

As described in Sections 1.1 through 1.5 below, choices made during the development of an ISMS are affected by a number of factors. For example, ISMSs can vary significantly among sites (even for similar activities), among facilities (even at the same site), and among activities (even within the same facility). Other factors that may affect SMS integration include– • the relative responsibilities of DOE and contractor personnel; • business processes, such as budget and resource allocation; • the type of contract in place; • the nature of the hazard (i.e., nuclear, chemical, fire, industrial, environmental, and combinations of these potential hazards); and • the scope of the threat (local, sitewide, public, environmental, and combinations of these individuals and sectors) posed by the hazard. 1.1 SMS Integration by Site, Facility, and Activity In general, operating organizations use corporate and sitewide safety programs (e.g., fire protection and emergency planning) as well as facility- and activity-specific safety processes. Some of these programs are established at the site level to address, for example, radiation protection, environmental protection, industrial hygiene, industrial safety, and emergency CANCELE D Volume 1 - Integrated Safety Management System Guide - Page 7 Chapter I 5-27-99 DOE G 450.4-1A planning. Other programs, such as those for configuration management and conduct of operations, are more appropriately specified at the facility or project level. And some processes, such as quality inspection, or those used for Enhanced Work Planning (EWP), can be specified at the task level. All safety control measures, programs, and processes, regardless of the level at which they are specified, and regardless of whether they are mandatory or voluntary, flow down and must be implemented at the appropriate work level to achieve adequate safety. Both DOE and the operating organization should review existing processes and programs to ensure they are integrated, flow down to the task/activity work level, and adequately address ISMS requirements. For these reasons, an ISMS must include processes for selecting and applying site and facility processes or procedures to use in developing work-specific control measures. DOE and its contractors also use a variety of voluntary safety initiatives that are outside the contract/regulatory structure. The EWP initiative, for example, can be used for developing ISMS objectives and expectations at the task/activity level. Managers and workers at all organizational levels should be involved in developing, maintaining, and improving the controls that must be applied to work at the task/activity level. Safety must take top priority in keeping the workplace as free as possible of recognized hazards, which might endanger workers, the public, or the environment. Figure 1 illustrates the layered structure that characterizes an ISMS. Each circle represents a single organizational level; that is, the institution or site level, the facility level, and the activity level. Individuals at each level of the organization play a role in work and safety planning. As illustrated in Figure 1, the core safety functions are integrated activities at each level. • At the facility and activity levels, workers (i.e., operational staffs) are essential in identifying and implementing controls and performing work.

• At the facility level, multiple activities are defined and the work is planned and integrated so as not to delay, interfere, or hinder other activities. The results of this lower-tier integration feed back to higher tiers in the line management chain for integration with other programs. • At the institutional or facility level, the scope of work is defined using input from DOE (via contracts) and from the lower-level line managers and facility workers who have detailed knowledge of the work activities. CANCELE D Page 8 - Integrated Safety Management System Guide - Volume 1 5-27-99 Chapter I DOE G 450.4-1A Figure 1. An illustration of major interactions between organizational levels for the five SMS core functions. Figure 2 shows how sitewide activities overlay the facility, activity, and work for a Hazard Category 2 facility. Although the SMS Policy is the same for all facilities and activities, the contractor’s safety control measures are tailored to the site, facility, and activity based on the hazards and work being performed. CANCELE D Volume 1 - Integrated Safety Management System Guide - Page 9 Chapter I 5-27-99 DOE G 450.4-1A Figure 2. An illustration (derived from Defense Nuclear Facilities Safety Board Tech-16) of typical safety management programs and controls at various organizational levels for a Hazard Category 2 nuclear facility. CANCELE D Page 10 - Integrated Safety Management System Guide - Volume 1 5-27-99 Chapter I DOE G 450.4-1A 1.2 Integration of DOE and Contractor Roles Another aspect of integration is the complementary nature of DOE and contractor responsibilities in ensuring integration of safety. Contractor responsibilities are typically defined in the DEAR contract requirements and are incorporated in the contract, corporate policies, and manuals. Application of these documents is outlined in the contractor’s ISMS description. Although the DEAR specifies some DOE responsibilities, most are described in the FRAM. Each line, support, oversight, and enforcement organization within DOE is responsible for establishing a lower-tier FRA document specifying how their functions and responsibilities, as assigned in the FRAM, are to be properly discharged. The FRAM also provides an overview of the interfaces between DOE functions and those of operating organizations; that is, Government-Owned, Contractor-Operated (GOCO) facilities and Government-Owned, Government-Operated (GOGO) facilities. Such safety management responsibilities include budget management as well as the use of feedback from oversight and review functions. 1.3 Integration of Safety and Business Processes Determining budget and resource allocations necessary to provide safe operations must be integrated with both DOE’s and the contractor’s annual planning and budget cycle. A first step is to translate missions into work requirements in conjunction with the prioritization of budget and resources. By accomplishing the two tasks—work analysis and budget formulation—in tandem, DOE can more accurately estimate the funding required for safety analysis and control of hazards associated with the task. Both DOE and contractor line managers should take the lead in bringing safety expertise to bear in support of those programs/activities for which they are responsible [see DEAR 48 CFR 970.5204-2(b) and (e)]. Integrated safety management should also identify and communicate any projected vulnerabilities and risks not addressed within the projected budget. This ensures that DOE is aware of any potential site vulnerabilities and provides an opportunity to develop and enforce risk management options and strategies, including re-scoping activities, re- allocating funds and resources to address the vulnerabilities, or identifying the consequences of proceeding without addressing them.

1.4 Integration by Type of Risk and Hazard Integration allows for effective and efficient management of risk to workers, the environment, and the public. It is DOE line management’s responsibility to ensure that contractors– • develop and effectively implement an ISMS tailored to the risk of the work and the associated hazards and • develop and effectively integrate their safety management systems with the business and operational systems throughout their organizations. CANCELE D Volume 1 - Integrated Safety Management System Guide - Page 11 Chapter I 5-27-99 DOE G 450.4-1A The integration process must also address all hazards and the possible risks these hazards may present to workers, the public, and the environment. Individuals responsible for engineering the processes (e.g., weapons assembly and disassembly, nuclear material fabrication and stabilization, criticality experiments, waste storage, hazardous waste cleanup, routine maintenance, pollution prevention, and waste minimization) should work with multidisciplinary teams who have direct responsibility for analyzing hazards, identifying control measures derived from that analysis, and ensuring those measures are effective. Similarly, individuals responsible for operations should have direct responsibility for the safety of those operations and should be given the resources to implement the necessary controls. 1.4.1 Integration of Risk (Worker, Public, and the Environment) Systems for worker safety, industrial hygiene, medical services, radiation worker protection, safeguards and security, emergency response, emissions control, waste management, public safety, and environmental protection perform more effectively and efficiently when they are integrated. For that reason, managers responsible for individual systems should know where each of their processes interfaces with a process owned by another organization. Responsible managers should then communicate routinely with interfacing managers to assess the efficiency and effectiveness of the process and communicate immediately whenever changes occur that have an impact on one or more interfaces. An ISMS provides the structure by which specific activities can be carried out by different organizations while adopting a uniform approach to protecting the workers, the public, and the environment. At the same time, an ISMS allows an organization the flexibility to adapt and improve systems to its needs, priorities, and changing mission and environment without jeopardizing the needs, priorities, and missions of other, interfacing organizations. Worker Safety When worker safety is managed as a vital and valued part of an integrated safety management system, both managers and workers gain ownership in the process. As a result, work can be conducted safely and work processes can be continuously improved. To be successful, however, a viable worker safety system requires commitment from managers and meaningful involvement of workers. Meaningful worker involvement requires each and every employee in an organization to be held accountable for his or her safety performance. CANCELE D Page 12 - Integrated Safety Management System Guide - Volume 1 5-27-99 Chapter I DOE G 450.4-1A Meaningful management commitment to worker safety requires the following: C providing adequate resources for risk management; C training workers how to work safely; C ensuring compliance with all applicable requirements and regulations;

C ensuring accountability for safety performance; C soliciting worker input regarding workplace hazards and selection of appropriate controls; • identifying existing and potential workplace hazards and evaluating the risk of associated worker injury or illness; • encouraging worker responsibility to demonstrate a strong, questioning attitude regarding work and the hazards associated with the work; • ensuring strict compliance with precautions, limitations, requirements, and constraints of work control documents, including work site conditions; • empowering workers to exercise their Stop Work authority; • communicating risk with the worker; • implementing a process to ensure that all identified hazards are managed through a process of prevention/mitigation or control; • selecting hazard controls based on the following hierarchy: - engineering controls, - work practices and administrative procedures, and - personal protective equipment; • identifying Occupational Safety and Health Standards; and • implementing radiological protection policy and practices based on the precept that radiological exposures for workers should be kept as low as reasonably achievable (ALARA). CANCELE D Volume 1 - Integrated Safety Management System Guide - Page 13 Chapter I 5-27-99 4 See DOE STD-1120, Integration of Safety and Health into Facility Disposition Activities and DOE-EM-STD-5502, Hazard Baseline Documentation. DOE G 450.4-1A Public Safety Integrating public safety into operations requires increased and intentional management awareness and commitment. Work planning must include the consideration of its possible impact on public safety. Every impact that is identified must be managed as a hazard to worker safety would be managed, and subjected to the same responsibility and accountability—as part of an integrated safety management system. Public protection is ensured via rigorous application of the ISMS core functions and principles. The cornerstone of that effort is a thorough understanding of the hazards attained by means of a comprehensive safety analysis program and the implementation of robust control measures. DOE provides considerable guidance for the analysis and evaluation of all types of hazards through its requirements for safety analysis reports (SARs) for nuclear facilities and operations or their equivalents4 for other types of facilities and operations (e.g., chemical and industrial activities). Although DOE-STD- 1120 is specifically written for disposition activities, it provides guidance for all types of hazards and the methodology is generally applicable to other parts of the facility life cycle. Environmental Protection The following techniques and methods for dealing with environmental risks are consistent with the guiding principles and core functions to be addressed in an ISMS. Threats to the environment are generally addressed through environmental assessments (EAs) or environmental impact statements (EISs), which are required by NEPA (National Environmental Protection Act, 10 CFR 1021). In addition, environmental management systems (EMSs) used by the Federal government should be integrated with the ISMS (see Section 3 of DOE STD-1120). An EMS is that part of the overall management system that includes organizational structure, planning activities, responsibilities, practices, procedures, processes, and resources for developing, implementing, achieving, reviewing, and maintaining the environmental policy. A discussion of EMSs is provided in DOE/EH-0573, Environmental Management Systems Primer for Federal Facilities.

An EMS provides the structure by which specific activities can be carried out efficiently and in a manner consistent with key organizational goals; an EMS also allows an organization the flexibility to adapt the system to its needs and priorities. CANCELE D Page 14 - Integrated Safety Management System Guide - Volume 1 5-27-99 Chapter I DOE G 450.4-1A The EMS approach has its genesis in the same movement that created the “quality management” systems traditionally applied to manufacturing. The two predominant EMS documents are the Code of Environmental Management Principles for Federal Agencies (CEMP) and ISO 14001. CEMP was developed by the Environmental Protection Agency (EPA) in response to Executive Order 12856, Federal Compliance with Right-to-Know Laws and Pollution Prevention Requirements, signed on August 3, 1993. EPA patterned the CEMP on the common critical elements of a comprehensive management system tailored to the environmental activities of an organization (i.e., an EMS). CEMP uses a construct of five broad principles and underlying performance objectives as the basis for Federal agencies to move toward responsible environmental management. CEMP principles help ensure environmental performance that is proactive, flexible, cost-effective, integrated, and sustainable. ISO 14001, developed by the International Organization for Standardization, provides a comparable EMS construct that is being implemented throughout the world. The guiding principles and core functions of an ISMS correspond to the elements of an EMS. Thus, an effective ISMS will address the environmental aspects of the safe completion of mission. DOE is responsible for transitioning facilities from operational status to deactivation and eventual dismantlement or reuse. The characterization of hazards from residuals in such facilities and the establishment of controls to maintain safety during the interim must account for DOE responsibilities under the Atomic Energy Act. However, the controls should also be compatible with the subsequent transition to regulation by EPA and the States during the final disposition of facilities under the Comprehensive Environmental Response, Compensation, and Liability Act (CERCLA), the Clean Water Act (CWA), the Clean Air Act (CAA), and the Resource Conservation and Recovery Act (RCRA) (e.g., decommissioning of the plutonium concentration facility, 233-S, at Hanford). DOE- STD-1120 provides guidance for such disposition activities. State, local, and Federal government permits and the controls to implement them (e.g., CERCLA, CAA, and RCRA permits) need to be included in the ISMS. 1.4.2 Hazard Types An ISMS should have similar and consistent processes for dealing with different types of hazards; that is, nuclear, chemical, and industrial hazards, and natural disasters. Such processes include analysis, development of technical or administrative controls, hazard avoidance and prevention, and implementation of any mitigating measures. For example, permits (both internal and external) issued by different groups at the activity level need to CANCELE D Volume 1 - Integrated Safety Management System Guide - Page 15 Chapter I 5-27-99 DOE G 450.4-1A be integrated to preclude duplication of effort and to ensure protection of the worker, the public, and the environment. Further, for processes involving multiple types of hazards, consideration should be given to the use of worker/management teams with a variety of expertise to ensure that each type of hazard receives informed consideration. EWP can be used to accomplish this integration.

1.4.3 Integration Responsibility Everyone has a role in integrating safety on site! Line management is responsible and accountable for safety, safety management, and the integration of safety into business and operations at a site. Line management is responsible for appropriate use of ES&H in performance of safety assessment tasks. Line management translates mission into work, sets clear and prioritized expectations, directs the work, and bears accountability for the results. Workers are responsible for participating in the safety management process to the level of their responsibility and accountability for performing work safely. Depending on the level of responsibility, each worker needs to ask, “How do I know safety has been integrated into my work?” and “How do my activities contribute to safety?” Line management directs work and helps workers translate missions into work, set expectations, prioritize tasks, identify preliminary hazards to determine resource allocation and priority assignment, and develop program plans that outline resources, priorities, and tasks balanced against risks. Workers, on the other hand, perform work and should question whether their work is defined clearly enough to work safely. This is accomplished through stand-up meetings with supervisors, practical training, feedback, and pre-job briefings. 1.5 Integration by Phase of Facility Life Cycle The five core functions (see Table 1 in Chapter II) of the integrated safety management process can be used at any stage of the facility life cycle (see Figure 3). The exact nature of the activity changes as the safety processes are integrated– • first, with the conceptual design, preliminary design, and final design activities; • second, with the engineering design and development activities; • third, with the more traditional integrated safety management activities associated with the physical plant during the construction and operational phases; and • finally, with the activities to be performed during facility disposition. CANCELE D Page 16 - Integrated Safety Management System Guide - Volume 1 5-27-99 Chapter I DOE G 450.4-1A The seven guiding principles of integrated safety management (see Table 1 in Chapter II) are as applicable to controlling conceptual design as to controlling facility operations and facility disposition. Early implementation ensures that safety is integrated into the design process and that operational safety issues are addressed early enough to affect the design. Addressing safety measures early in the process permits cost-effective solutions to be implemented and prevents the use of inappropriate and overly costly controls on hazards that can be reduced or eliminated. The ISMS follows the same basic approach during all phases of facility disposition (deactivation, decommissioning, and long-term surveillance and monitoring). DOE-STD-1120-98 describes the application of ISMS to all facility disposition activities. 2. ISMS DEVELOPMENT AND IMPLEMENTATION PROCESSES AND PRODUCTS DOE and the contractor should follow the steps outlined in the following sections to develop, review, approve, implement, and monitor an ISMS that is fully integrated with the work. Additional guidance on these development and implementation steps is provided in Chapter III and in Appendixes D, E, and F. 2.1 Develop and Document the ISMS in Accordance with Requirements in the DEAR

The process for developing and documenting an ISMS is specified in the DEAR, 48 CFR 970.5204. It includes the following provisions: • Each contractor is to manage and perform work in accordance with a documented ISMS that fulfills all conditions in 48 CFR 970.5204-2(b) and (c) at a minimum. Paragraph (b) of the clause describes the seven guiding principles of the SMS Policy. Paragraph (c) also lists the five core functions. • Each contractor is to submit its ISMS documentation of to the CO for review and approval. The CO then establishes dates for submittal, discussions, and revisions to the SMS [per 48 CFR 970.5204-2(e)]. • The contractor-integrated SMS documentation is to describe how the contractor will perform the five core functions using the seven guiding principles [48 CFR 970.5204- 2(c)]. In addition, the ISMS documentation is to describe how the contractor will establish, document, and implement safety performance objectives, performance measures, and commitments in response to DOE program and budget execution guidance while maintaining the integrity of the ISMS. • The ISMS documentation shall also describe how the contractor will measure system effectiveness [48 CFR 970.5204-2(d)]. • The SMS is to be integrated with the contractor’s business processes for work planning, budgeting, authorization, execution, and change control [48 CFR 970.5204-2(e)]. CANCELE D Volume 1 - Integrated Safety Management System Guide - Page 17 Chapter I 5-27-99 DOE G 450.4-1A Chapter III, Section 3.2, provides guidance that may be helpful in complying with these requirements. The DEAR [48 CFR 970.5204-2(e)] also requires the contract to include safety performance objectives and measures, which should cover both sitewide parameters (such as injury-caused lost days of work), specific program measurements (such as SAR approval), and ES&H priorities specific to the work to be accomplished. The DEAR also requires that the contractor measure the performance of the ISMS. Because of the potentially broad application of performance measurement and the opportunity to share the results across programs and at all levels of management, the development of performance objectives and measures is an important integration activity. 2.2 Review and Approve the ISMS as Required by the DEAR and in Accordance with DOE Responsibilities in the FRAM DOE personnel must review and approve ISMSs in accordance with the DEAR [48 CFR 970.5204-2(e)] and the FRAM. The process for implementing review and approval is discussed in Chapter III, Section 4.0, and in Appendix E. Additionally, the Office of the Deputy Assistant Secretary, Oversight (EH-2), performs oversight of DOE safety management functions. The FRAM is organized in accordance with the Policy and addresses DOE responsibilities and authorities for each of the five core functions. 2.3 Evaluate the ISMS Implementation The contractor should ensure that its approved ISMS description has been implemented. This is done initially with the CO-implemented review and approval. Additional ISMS reviews are done in accordance with DOE P 450.5. DOE evaluates implementation of the ISMS in accordance with the DEAR and the FRAM. This evaluation is an effective process for ensuring the contractor’s SMS is integrated and working as described in the ISMS documentation. 2.4 Monitoring and Annual Update of the ISMS in Accordance with Requirements in the DEAR The DEAR requires the following:

On an annual basis, the contractor shall review and update, for DOE approval, its safety performance objectives, performance measures, and commitments consistent with and in response to DOE’s program and budget execution guidance and direction [48 CFR 970.5204.2(e)]. Work processes and organizational safety management performance should be continuously measured and evaluated to ensure that line management is aware of the contractor’s compliance CANCELE D Page 18 - Integrated Safety Management System Guide - Volume 1 5-27-99 Chapter I 5 DOE P 450.5, LINE ENVIRONMENT, SAFETY AND HEALTH OVERSIGHT, provides key elements of the line environment, safety and health (ES&H) oversight process. The full text of this Policy is provided in Attachment 2. DOE G 450.4-1A with the documented SMS5. Accordingly, DOE and contractor organizations perform management and independent assessments using quantitative and/or qualitative information obtained from a variety of sources (e.g., in-process monitoring, performance indicators, occurrence reports, trending, statistical analysis, management assessments, independent assessments, and workers, customers, suppliers, regulators, and stakeholders). Because such evaluations are conducted at all organizational levels, they contribute to safety management integration. Improvement actions identified are shared with similar organizations and are tracked throughout implementation to determine whether they are yielding the anticipated improvements. Evaluation reports, which document the process followed, the results, and measurements indicating the success of the improvements, are part of the ISMS. 3. TAILORING THE ISMS Because work can range in complexity and hazard potential from high-hazard operations in major facilities to much simpler tasks, such as replacement of a contaminated component, DOE safety management directives are structured to address a variety of hazardous operations. In this context, tailoring is directed principally at developing safety controls fitted to the hazards and the work. Through tailoring, existing guidance and safety management processes can be selectively applied to planned work activities to meet applicable, enforceable requirements while adequately protecting health, safety, and the environment. The DEAR environment, safety, and health clause [48 CFR 970.5204-2(b)(6)] and the SMS Policy state explicitly that administrative and engineering controls to prevent and mitigate hazards shall be tailored to the work and associated hazards. To meet this requirement, DOE and contractor personnel at all levels should not only tailor their ISMSs, but should also evaluate the effectiveness of their work management systems to continuously improve system performance. Work management systems must deal effectively with a full spectrum of work types and work activities. They must allow flexibility in planning, analysis, and work preparation, which, in turn, includes tailoring the work and hazard controls to the work at hand. As a result, a successful ISMS should ensure high-quality work and compliance with predetermined performance expectations, while continuously ensuring that work is conducted in an environmentally sound, safe, and healthy way. DOE G 450.3-3, TAILORING FOR INTEGRATED SAFETY MANAGEMENT APPLICATIONS, provides guidance for tailoring an ISMS and its core functions. CANCELE D Volume 1 - Integrated Safety Management System Guide - Page 19 Chapter II 5-27-99

6 Chapter II contains general discussions of the Core Functions and Guiding Principles. Chapter III (in parentheses) provides review considerations regarding implementation of the Core Functions and Guiding Principles in an ISMS. DOE G 450.4-1A CHAPTER II ISMS CORE FUNCTIONS AND GUIDING PRINCIPLES This chapter describes the seven guiding principles and five core functions set forth in the SMS Policy (DOE P 450.4) and DEAR clauses. Attachments 1 and 5 contain the full text of the Policy and DEAR SMS clauses. The three guiding principles that relate to all core functions are discussed first. The remaining five sections in this chapter correspond to each of the five core functions and include discussions of other guiding principles that apply (see Table 1 below). Table 1. Matrix Showing How and Where Core Functions and Guiding Principles are Addressed in this Guide Core Functions [See 48 CFR 970.5204-2(c).] Guiding Principles [See 48 CFR 970.5204-2(b).] Chapter and Section Number - 1. Line Management Responsibility II.1 (III.3.6)6 - 2. Clear Roles and Responsibilities II.1 (III.3.6) - 3. Competence per Responsibilities II.1 (III.3.7) 1. Define Scope of Work 4. Balanced Priorities II.2 (III.2.1.1) 2. Analyze Hazards - II.3 (III.3.1.1) 3. Develop and Implement Controls 5. Identification of Safety Standards 6. Tailor Hazard Controls to Work II.4 (III.3.1.2) 4. Perform Work 7. Operations Authorization II.5 (III.3.1.3) 5. Feedback and Improvement - II.6 (III.3.1.4) Figure 3 illustrates the conceptual relationship among the core safety management functions. However, these functions are not independent, sequential functions but instead, a linked, CANCELE D Page 20 - Integrated Safety Management System Guide - Volume 1 5-27-99 Chapter II DOE G 450.4-1A Figure 3. Relationship of the SMS Core Functions. interdependent collection of functions that often occur at the same time. The output of each function can affect the results of each of the other functions and, potentially, the whole system. Work planning, for example, affects multiple functions several times before a plan is executed. For instance, by identifying and eliminating hazards during work planning, an organization can reduce the potential for related accidents later. During a Pollution Prevention Opportunity Assessment, options can be identified to reduce or eliminate the use of a toxic chemical, thereby minimizing a hazard to workers and the environment. Similarly, assessment and feedback conducted at any time during the performance of one function can and should affect future planning. CANCELE D Volume 1 - Integrated Safety Management System Guide - Page 21 Chapter II 5-27-99 DOE G 450.4-1A Generally, for complex sites or facilities, the five functions are reiterated, with the exchange of information among participants progressing from a broad overview to detailed task descriptions. The reader of this Guide should, therefore, consider the core safety management functions as an integrated whole; however, for ease of presentation, the functions are discussed separately in this chapter. It is important to recognize the iterative character of ISMS functions and the need to integrate specific activities within the functions. An activity like training, for example, may be necessarily addressed in all five core functions. 1. GUIDING PRINCIPLES 1, 2, AND 3 The following three guiding principles relate to responsibilities intrinsic in all five core functions and are therefore addressed here:

• Line Management Responsibility for Safety, • Clear Roles and Responsibilities, and • Competence Commensurate with Responsibilities. These interrelated guiding principles help ensure the management structure has personnel who focus on safe accomplishment of mission, understand their assignments, and can carry out the core safety management functions correctly and efficiently. These principles are dependent upon management commitment and employee involvement. Management commitment is demonstrated by the documented ISMS and policy statements that are communicated throughout the organization, managers’ accountability for safety performance, and the visible presence of managers addressing safety issues. Management commitment is also demonstrated by fostering employee involvement in development and implementation of the ISMS, and emphasizing the importance of individual accountability for performing work safely. Employees/workers should be actively and continually involved in the development and deployment of the ISM processes that execute the ISM function. As individuals and as work teams, employees/workers actively participate in the activities of the ISM processes that address workplace safety, public safety, and environmental protection. Employees/workers continually examine the ISM management processes used to conduct their individual work efforts for continual improvement and actively pursue these improvements with contractor management. Individual accountability for performing work safely is emphasized. To be used effectively, these principles are dependent upon management commitment and employee involvement. Management commitment can be demonstrated by the following actions: • Management communicates the documented ISMS and policy statements throughout the organization. • Managers are held accountable for safety performance. • Managers are visibly present, addressing safety issues. CANCELE D Page 22 - Integrated Safety Management System Guide - Volume 1 5-27-99 Chapter II DOE G 450.4-1A • Managers invite and encourage employees at all levels to participate in development and implementation of the ISMS. • Managers emphasize the importance of individual accountability for performing work safely. The ultimate responsibility and accountability for ensuring adequate protection in the operation of DOE facilities, while meeting mission requirements, rests with DOE line management, as described in this section. This principle relies upon a chain of responsibility that extends from the Secretary, through DOE line management and COs, to contractor management and workers: • DOE, as described in the FRAM, assigns safety responsibility and authority to DOE and contractor line management. • DOE, as described in the FRAM, assigns safety support responsibilities to organizations outside of line management. • DOE and contractor line managers are responsible for integrating safety into work. • DOE and contractor line managers are responsible for ensuring competence of their workforces and line managers. 1.1 DOE Responsibilities The FRAM establishes the responsibilities for managing those functions that are fundamental to safety management and that need to be performed consistently throughout the Department. In accordance with the first guiding principle, Line Management Responsibility for Safety, the FRAM specifies DOE safety management functions with clear lines of responsibility and authority that are necessary to–

• define essential safety management functions; • ensure compliance with legal and contractual requirements; and • implement the standards necessary to provide reasonable assurance that workers, the public, and the environment are adequately protected. Line management includes any management level within the line organization that is responsible and accountable for directing and conducting work. Accordingly, line managers (i.e., Secretarial Programmatic Officers and Field Managers) are responsible for ensuring operational safety and ES&H compliance with requirements established by contract terms and conditions. It is CANCELE D Volume 1 - Integrated Safety Management System Guide - Page 23 Chapter II 5-27-99 DOE G 450.4-1A recognized that these responsibilities include the identification and use of ES&H professionals in performance of some tasks important to safety. The FRAM is a corporate-level directive. As such, the FRAM addresses functions, responsibilities, and authorities for DOE organizations responsible for overall direction of integrated safety for all DOE operations and facilities. The FRAM also describes roles and responsibilities for setting Departmental direction, a step that must take place before implementation of the safety management functions, plans, mission statements, budget resource allocation, and the technical competence qualifications required of staff. Implementation details are addressed in lower-tier FRA documents, which are required by the FRAM Policy, DOE P 411.1, for each line, support, oversight, and enforcement organization within DOE. These lower-tier FRA documents specify the functions to be performed and who has the responsibility and authority for performing those functions. The second guiding principle, Clear Roles and Responsibilities, builds upon the first by stating the following: Clear and unambiguous lines of authority and responsibility for ensuring safety shall be established and maintained at all organizational levels within the Department and its contractors. The FRAM establishes a continuous line of authority from the Secretary to the DOE interface with contractors by defining DOE roles and responsibilities for Headquarters and field element line management. The FRAM addresses the second guiding principle, Clear Roles and Responsibilities, as follows: • clearly delineate management and safety responsibilities for approving the contractor’s ISMS and other binding agreements that implement the ISMS; • clarify the roles, responsibilities, lines of authority, and delegations between Headquarters and field organizations; • define functional relationships and responsibilities among DOE line, support, oversight, and enforcement organizations; and • address the coordination of line management direction from multiple program offices at a single site. The FRAM also addresses the third guiding principle, Competence Commensurate with Responsibilities, by assigning each DOE element the responsibility for ensuring that its employees are qualified to perform their assigned functions. The Assistant Secretary for Management and CANCELE D Page 24 - Integrated Safety Management System Guide - Volume 1 5-27-99 Chapter II DOE G 450.4-1A Administration (MA-1) is assigned responsibility for assisting DOE line managers in recruiting and retaining highly qualified technical personnel. In addition to the FRAM, other DOE directives provide direction for training and qualifying personnel; some are listed below:

• DOE O 360.1, TRAINING, provides requirements for establishing, implementing, documenting, and evaluating training programs for Federal employees. • DOE O 541.1, APPOINTMENT OF CONTRACTING OFFICERS AND CONTRACTING OFFICER REPRESENTATIVES, specifies qualifications for contract officers. • DOE O 414.1, QUALITY ASSURANCE, establishes quality assurance (QA) objectives and requirements. The DOE Core Technical Group (CTG) has been established to support and supplement line management as needed for special issues or projects. This group consists of technical experts who may be used by DOE line organizations. 1.2 Contractor Responsibilities In accordance with the first guiding principle, Line Management Responsibility for Safety, contractor line management is responsible for ensuring that work is performed safely, in a manner that ensures adequate protection for employees, the public, and the environment. Line management includes those contractor and subcontractor employees managing or supervising employees performing work. The second guiding principle, Clear Roles and Responsibilities, builds upon the first by stating– Clear and unambiguous lines of authority and responsibility for ensuring safety shall be established and maintained at all organizational levels within the Department and its contractors. The DOE Quality Assurance rule (10 CFR 830.120) applies to contractors operating DOE nuclear facilities. In addition, DOE O 414.1 is a contractual requirement for many DOE contractors. Both the CFR and the Order contain specific requirements for documenting the organizational structure, functional responsibilities, levels of authority, and interfaces for those managing, performing, and assessing the work. These details may be provided by reference to the contract, regulations, and other contractor-specific documents. The contractor’s description of its ISMS organization should clearly define roles and responsibilities by specifying how contractor functions are to be carried out and identifying who has the responsibility and authority to carry out those functions. Note that the organizational CANCELE D Volume 1 - Integrated Safety Management System Guide - Page 25 Chapter II 5-27-99 DOE G 450.4-1A description in the ISMS should not be so detailed that minor organizational or personnel changes would require it to be revised. The organizational description of contractor responsibilities should clearly demonstrate that line management has responsibility for safety. In addition, the description should indicate how responsibilities flow from the contractor’s senior management to the worker. Just as with DOE, the contractor’s organization should emphasize the flowdown of safety responsibilities through the chain of line management to the worker. In addition, the description should address contractor flowdown to subcontractors and suppliers, which is required by DEAR 970.5204-2, as follows. Contractors are responsible for ensuring subcontractors are held accountable for ES&H requirements by– • clearly specifying ES&H requirements pertinent to the work scope in the request for proposals; • specifying ES&H requirements in the contract language; • providing daily oversight of the subcontractor’s performance of work by a subcontract technical representative; • ensuring that safety and health representatives oversee the work site; • providing site-specific training to subcontractors; and

• ensuring that safety professionals review and approve all safety plans and hazard communication programs before the start of any project. Depending on the complexity and hazards associated with the work, the contractor may require that the subcontractor submit a Safety Management System for the contractor’s review and approval. In addition to requiring clear lines of responsibility and authority [DEAR 970.5204-2(b)(2)], DEAR 970.5204-2(b)(3) requires the contractor to ensure personnel possess the experience, knowledge, skills, and abilities necessary to discharge their responsibilities. Therefore, the contractor’s ISMS description should address the third guiding principle, Competence Commensurate with Responsibilities, by identifying the qualifications required for specific contractor positions. Federal Acquisition Regulation (FAR) 15.605 and 41 United States Code (U.S.C.) 253a require that “evaluation factors” be used in selecting DOE contractors. FAR 15.605 also cites CANCELE D Page 26 - Integrated Safety Management System Guide - Volume 1 5-27-99 Chapter II 7 May also be called a “statement of work.” DOE G 450.4-1A management capability and personnel qualifications as factors that must be evaluated. Accordingly, contractor management determines the basis for selecting individual qualifications for specific position/job responsibilities. Qualifications and capabilities are provided via position/job descriptions, resumes of key personnel, or other, similar descriptions. The following directives contain information for ensuring that personnel have the necessary qualifications: • DOE 5480.20A, PERSONNEL SELECTION, QUALIFICATION, AND TRAINING REQUIREMENTS FOR DOE NUCLEAR FACILITIES; • DOE O 440.1A, WORKER PROTECTION MANAGEMENT FOR DOE FEDERAL AND CONTRACTOR EMPLOYEES; and • DOE O 414.1/10 CFR Part 830.120, QUALITY ASSURANCE. 2. CORE FUNCTION 1, DEFINE SCOPE OF WORK, AND GUIDING PRINCIPLE 4, BALANCED PRIORITIES DOE and the contractor identify and prioritize work and allocate resources. The contractor’s role in this core function is generally to translate broad missions into specific work packages. DOE provides performance expectations by strategic plans, goals, and objectives, and through program execution guidance. A well-defined scope of work7 is critical to the success of an SMS because– • it sets the stage for the scope and depth of hazards identification/analysis, • it is the foundation for the budget formulation/allocation process, and • it is the primary factor in establishing expectations and accountability. A fundamental objective of Core Function 1, Define the Scope of Work, is to identify the scope, schedule, and costs of activities necessary to achieve DOE missions and expectations in a safe and environmentally sound manner. 2.1 Describing the Work Work planning begins the integration of all systems pertinent and necessary to a process, operation, or task. The responsible manager is accountable for understanding as completely as possible the work to be done through every phase of the work cycle: (l) inception, (2) development and planning, (3) work conduct, and (4) shutdown. CANCELE D Volume 1 - Integrated Safety Management System Guide - Page 27 Chapter II 5-27-99 DOE G 450.4-1A

To fulfill its operational responsibilities, line management must first determine the work to be performed. To do that, DOE and contractor line management organizations should establish formal processes for translating DOE mission statements into a scope of work. These processes should be used to establish expectations for satisfactorily accomplishing the work, prioritizing tasks, and allocating resources. DEAR 970.5204-2(b)(4) requires resources to be effectively allocated to address ES&H, programmatic, and operational considerations to ensure that DOE attends to its most significant hazards first, in a cost-effective manner. Therefore, when translating the mission into a meaningful definition of the work, DOE and contractor line management, including the Cognizant Secretarial Officer (CSO), must prioritize resources to ensure that work and safety are integrated, and that sufficient resources are available to conduct the work safely. Each field office is expected to develop appropriate work plans, delineating scope, schedule, and funding allocations for each fiscal year. These plans should reflect the CSO mission assignments to the field and the mission in terms of work by facilities, projects, and programs (FRAM 9.2.1). The plans should also be consistent with– • the DOE budget formulation process; • DOE O 130.1, BUDGET FORMULATION; and • the annual budget, prepared by the Field Element Manager (FEM), and his or her contractors. At the Department or program level, work is generally defined in terms of broad mission objectives, major projects, key milestones, etc. At this level, DOE performance expectations (e.g., cost, safety, quality, pollution prevention, schedules, etc.) address both the work processes and the work product and are described in DOE strategic plans, goals, and objectives and in the contract. (Section 9.1 of the FRAM describes DOE’s development of strategic plans.) Below the Department or program level, DOE and its contractor organizations should establish a hierarchy of work planning processes so that the plan at each successively lower tier reflects an increasingly detailed description of the work to be performed. In this manner, broad DOE mission objectives are eventually translated into discrete tasks for contractor personnel to complete. DOE renders these descriptions into a formal scope of work through a variety of work authorizing means, including the following examples: program execution guidance (PEG) documents, the Albuquerque Workload Planning Guide (AWLPG), the Nuclear Weapons Production and Planning Directive (P&PD), the Office of Environmental Management (EM) Accelerated Cleanup: Paths to Closure, and project data sheets. Section 3.1 of DOE STD 1120 illustrates the work planning process down to the level of detail for a specific task or activity. CANCELE D Page 28 - Integrated Safety Management System Guide - Volume 1 5-27-99 Chapter II DOE G 450.4-1A 2.2 Determining the Level of Detail It is extremely important for DOE and its contractors to formally establish and clearly define the work to be performed, the priority assigned, and the expectations for completion. The level of detail required in a given scope of work should be commensurate with the importance of the work, its complexity, and the potential risk of the associated hazards.

In some cases, the level of detail contained within the contract scope of work may be adequate for both parties to clearly understand what is to be performed. In other cases, such as a management and operating contract for a large DOE site, the scope of work stated in the contract may be expressed in broad, general terms. Whatever the case, the work scope should include those activities (such as fire protection, radiation protection, training, etc.) that are necessary to control hazards associated with the work. If the scope of work is highly sensitive to changes in mission or annual budgets, it may be necessary to adopt a more formal way to clarify the statement of work. For research and development work conducted at a laboratory, for example, the scope of work may be simple: to conduct certain experiments and to report on the technical progress or results. But if additional detail is necessary, it can be provided through one or more documents formally required by the contract, such as the annual operating plan (AOP), project execution plan, implementation plan, award fee plan, accelerated cleanup, performance-based incentive, or activity description sheet (ADS). DOE O 430.1A, LIFE-CYCLE ASSET MANAGEMENT, establishes requirements for planning and planning approvals. Planning activities for decommissioning projects should be consistent with DOE and EPA memorandums of agreement. 2.3 Establishing Expectations Internally, each contractor organization should have one or more methods for establishing expectations for satisfactorily defining work, accomplishing work, prioritizing tasks, and allocating resources. Such methods may include contractor project management system(s); site/facility/activity operational plans and budgets; work packages, job plans, and special work permits; and project management plans and work plans, which can include objectives, costs, and methods. The use of multidisciplinary teams to conduct preliminary hazard analysis and develop hazard controls can enhance the contractor’s ability to define expectations clearly. Again, the formality required may depend upon the amount of work, its complexity, and the hazards. For complex, hazardous activities, a detailed work plan may be warranted, using inputs from operational staff who follow written procedures that require verbatim compliance. For low- hazard, simple activities, the method for establishing expectations may be much less formal; for example, simple verbal instructions provided by a supervisor to a worker may suffice for establishing a clear understanding of the work to be performed and how safety should be integrated with that work. CANCELE D Volume 1 - Integrated Safety Management System Guide - Page 29 Chapter II 5-27-99 DOE G 450.4-1A 2.4 Worker Participation in Work Planning Worker input should be integrated into planning activities. Methods for accomplishing this integration include (1) involving workers early in the planning process before work tasks are selected and assigned, (2) involving workers directly in the preparation and review of planning documentation, and (3) ensuring planners receive input from workers on proposed work methods, hazards, and controls. The benefits from these activities typically are improved worker morale, reduction in unknowns such as work conditions or hazards that impact planning effectiveness, and increased potential cost savings from improved work planning.

In developing an ISMS, DOE and the contractor should consider approaches for worker involvement that have been defined as a part of the DOE Voluntary Protection Program (VPP), Enhanced Work Planning (EWP), and Behavior Based Safety (BBS). More information on EWP can be found on the EWP Web site at http://tis-nt.eh.doe.gov/WPPHM/ewp/ewp2.htm. Additional information on VPP may be found on the DOE EH web site at http://www.tis.eh.doe.gov/. It is important to distinguish between DOE and other regulatory ES&H requirements and elective ES&H programs, such as ISO 14001, DOE-VPP, the Chemical Manufacturer’s Association’s Responsible Care, and EPA’s Project Xcel, which are available to DOE contractors who choose to go beyond compliance in environmental and/or worker safety and health management. These elective programs, consisting of management systems for preventing and controlling occupational and environmental hazards, augment ES&H protection at the site beyond DOE requirements. The responsible manager is accountable for communicating the parameters of the work to the workers involved. Successful planning, which happens only when managers and workers plan the work together, can efficiently and economically change work to eliminate or control hazards. Some examples of actions that managers may take to promote worker involvement in planning include the following: C Define and incorporate into written procedures, mechanisms for incorporating worker involvement and input to the work planning processes. C Involve workers early in the planning process. C Involve workers directly in the preparation and review of planning documentation and job hazard analysis, and ensure that planners incorporate input from workers on proposed work methods, hazards, and controls. C Hold line managers accountable for including workers in the work planning process. CANCELE D http://tis-nt.eh.doe.gov/WPPHM/ewp/ewp2.htm http://www.tis.eh.doe.gov/ Page 30 - Integrated Safety Management System Guide - Volume 1 5-27-99 Chapter II DOE G 450.4-1A C Obtain information from other sites where management/worker trust has been successfully addressed. C Incorporate improved management/worker relationships into the supervisory process using trust-building exercises and other behavioral change approaches. C Develop, publish, and make visible work-planning-related performance indicators that the workers can directly affect. C Obtain union buy-in for the worker involvement process, wherever possible. C Provide training for supervisors, managers, and work planners regarding effective use of worker input. C Establish safety committees. C Perform job hazard analyses. C Walk around with management. Worker safety is addressed in 29 CFR 1910, 29 CFR 1926,10 CFR 835, and DOE O 440.1A. The Department’s Voluntary Protection Program (DOE-VPP) is available to contractors seeking recognition for excellence in safety and health management. 2.5 Providing for Integration The ISMS should integrate environment, safety, and health into the contractor’s business processes for work planning, budgeting, authorization, execution, and change control. This requires integration within each line organization and integration among the different organizational elements (e.g., legal, procurement, business administration, engineering, facility and laboratory management, etc.).

Consistent with the guiding principles, some formal document should exist to establish clear lines of authority within each organization for defining the scope of work, including approval of subsequent changes. For contractors, this documentation would typically be a combination of company-level policies, charters established for organizational elements, and position descriptions. For DOE, the FRAM and the lower-tier FRA documents are the formal documentation that establishes clear lines of authority. In addition, a single work permit that replaces several permits (i.e., radiological, confined space, hot work, etc.) can be used to ensure that integration flows down to the first-line supervisors and workers. This single document should include all hazard information and controls required by the CANCELE D Volume 1 - Integrated Safety Management System Guide - Page 31 Chapter II 5-27-99 DOE G 450.4-1A individual permits while providing all information to the first-line supervisor and workers in a single document. Figure 4a illustrates the general concept of developing ES&H controls for various hazards and integrating them at the activity level. 2.6 Establishing Priorities Protecting the public, workers, and the environment is a top priority whenever the Department plans and performs work. Critical to this objective is providing adequate resources and ensuring that those resources are effectively allocated. Each organizational level (i.e., DOE Headquarters, DOE field element, contractor) should, therefore, establish a method for ensuring a proper balance among competing priorities of the organization (e.g., budget, schedule, safety, quality). To do this, organizations should establish a process for reconciling internal and external conflicts and imposing change control. In many cases, support activities, such as fire protection, radiation protection, training, etc., must be integrated into the work scopes for programs those activities support. Typically, a senior management review committee or council within DOE or the contractor organization may be established to resolve conflicts, establish priorities, and ensure a balance in resource allocation. In addition to Guiding Principle 4, Balanced Priorities, which demonstrates the Department’s focus on prioritization, DEAR 970.5204-2(b)(4) provides guidance for balancing priorities, as does DOE-DP-STD-3023-98, DOE Limited Standard, Guidelines for Risk-Based Prioritization of DOE Activities. An ISMS should address a variety of options and tradeoffs to promote the safe completion of work. These tradeoffs include negotiating work scope, establishing performance objectives, identifying resources, selecting personnel, and adjusting schedules. The goal is to define work and allocate resources so that work is done safely and contributes to accomplishment of the DOE mission. Each work package should be clearly defined so that the sum of the work packages is necessary to accomplish the assigned mission. DOE O 130.1, BUDGET FORMULATION, and DOE O 135.1, BUDGET EXECUTION— FUNDS DISTRIBUTION AND CONTROL, address DOE budget formulation and execution activities. Contract performance measures are a key feature of performance-based contracting, which is required by 62 FR 34842 (which amends DEAR 48 CFR 970.1001). DOE G 120.1-5, GUIDELINES FOR PERFORMANCE MEASUREMENT, gives guidance on contract performance measures. 3. CORE FUNCTION 2, ANALYZE HAZARDS

The objective of hazards analysis is to develop an understanding of the potential for the hazard to affect the health and safety of the worker, the public, and the environment. Hazard controls are CANCELE D Page 32 - Integrated Safety Management System Guide - Volume 1 5-27-99 Chapter II DOE G 450.4-1A Figure 4a. An illustration derived from DNFSB Tech 16 of the development and integration of ES&H controls at the activity level. CANCELE D Volume 1 - Integrated Safety Management System Guide - Page 33 Chapter II 5-27-99 DOE G 450.4-1A then established based on this understanding and other factors related to the work. The analysis includes two steps: (1) identifying and categorizing the hazard and (2) analyzing accident scenarios related to hazardous work. In identifying hazards at the task/activity level, workers are a valuable resource for their knowledge of the process and its hazards. Categorization may address the character of the work [nuclear, chemical, thermal, electrical, and kinetic (motion)] and the magnitude of the hazard. Several other methods (e.g., checklist, “what-if,” HAZOP study, FMEA, etc.) are also suited to particular work environments and/or hazard magnitudes. DOE and its contractors have many acceptable ways of performing hazard analyses. For example, during work design, or in the early project planning stages, hazards may be identified and evaluated using broad, simple tools that delineate hazards and assess the potential magnitude of the harm. At this stage, a simple hazard analysis can be sufficient as a tool for design evaluation and design improvement. For nuclear facilities, the hazard analysis should be based on the direction in DOE 5480.23, NUCLEAR SAFETY ANALYSIS REPORTS, for identification of the safety-class and the safety-significant structures, systems, and components. This level of hazard analysis is then used as the foundation for more detailed analysis at the facility level, which in turn is used as the basis for the activity or task level hazard analysis. Two types of analysis methods commonly used by industry for evaluating hazards at the facility and task level are the process hazard analysis (PHA) and the job hazard analysis (JHA). [See DOE O 440.1A, WORKER PROTECTION MANAGEMENT FOR DOE FEDERAL AND CONTRACTOR EMPLOYEES; OSHA 29 CFR 1910.119, Process Safety Management (PSM) of Highly Hazardous Chemicals; and OSHA 3071, Job Hazard Analysis.] A JHA or a Job Safety Analysis (JSA) is a basic and widely used tool for analyzing and reviewing operations and procedures to identify potential worker protection hazards and deficiencies and can satisfy a significant portion of the worker-protection hazard-identification requirements at most workplaces. These hazard analyses are performed by experienced teams of hazard analysts, facility and systems engineers, process operators, human factors engineers, and facility workers. These may include safety professionals and technicians in specialities such as criticality, hazard analysis, radiological protection, industrial hygiene, and occupational safety. DOE has promulgated a number of directives (Policies, Orders, Notices, Standards, and Guides) that may be used for hazard analysis and hazard categorization. These include the following: • DOE 5480.23, NUCLEAR SAFETY ANALYSIS REPORTS, addresses nuclear facilities. • DOE O 420.2, SAFETY OF ACCELERATOR FACILITIES, addresses accelerator facilities. CANCELE D

Page 34 - Integrated Safety Management System Guide - Volume 1 5-27-99 Chapter II DOE G 450.4-1A • DOE 5481.1B, SAFETY ANALYSIS AND REVIEW SYSTEMS, addresses non-nuclear facilities. • DOE-STD-3009, Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Facility Safety Analysis Reports, describes SAR preparation and review process, includes the PSM process for nuclear facilities. This Standard also integrates the worker safety hazard review requirements of 29 CFR 1910.119 into the 5480.23 safety/hazard analysis and review process for identifying and understanding the hazards associated with highly hazardous chemicals. • DOE-STD-3011, Guidance for Preparation of DOE 5480.22 (TSR) and DOE 5480.23 (SAR) Implementation Plans; • DOE-EM-STD-5502, Hazard Baseline Documentation; • DOE-EM-STD-5503, Health and Safety Plan Guidelines; • DOE-HDBK-1100, Chemical process Hazard analysis; • DOE-STD-1027, Guidance on Preliminary Hazard Classification and Accident Analysis Techniques for Compliance with DOE Order 5480.23, Safety Analysis Reports; • DOE-STD-1120-98, Integration of Safety and Health into Facility Disposition Activities, provides specific guidance for safety management activities at facilities being deactivated or decommissioned. This DOE Standard focuses on the deactivation, decommissioning, and long-term surveillance and monitoring phases regarding SMS Policy requirements for facility disposition activities. Although this document primarily addresses disposition activities, the methods are generally applicable. • DOE O 440.1A, WORKER PROTECTION MANAGEMENT FOR DOE FEDERAL AND CONTRACTOR EMPLOYEES, provides general worker protection requirements for all DOE operations and establishes requirements for a comprehensive worker protection program that ensures that DOE and its contractor employees are afforded a level of health and safety at least equal to that provided to private-sector employees under the Occupational Safety and Health Act, 1970. DOE O 440.1A should be applied directly at the task or activity level. • DOE G 440.1-1A, WORKER PROTECTION MANAGEMENT FOR DOE FEDERAL AND CONTRACTOR EMPLOYEES GUIDE FOR USE WITH DOE O 440.1, provides specific guidance for undertaking exposure assessments at the worker task/activity level. For those activities not covered by HAZWOPER, multidisciplinary teams should CANCELE D Volume 1 - Integrated Safety Management System Guide - Page 35 Chapter II 5-27-99 DOE G 450.4-1A undertake hazards analysis at the task (activity) level using standard techniques like those described in this Guide. • DOE O 151.1, COMPREHENSIVE EMERGENCY MANAGEMENT SYSTEM, provides for comprehensive emergency management systems to accompany safety analysis. • DOE/DP-0135, U.S. Department of Energy Model Pollution Opportunity Assessment Guidance. • DOE O 452.2A, SAFETY OF NUCLEAR EXPLOSIVE OPERATIONS, provides requirements for nuclear explosive operations. • DOE G 452.2A-1A, IMPLEMENTATION GUIDE FOR DOE ORDER 452.2A, SAFETY OF NUCLEAR EXPLOSIVE OPERATIONS, provides guidance for nuclear explosive operations. • DOE-DP-HDBK-XXXX, Draft HAR Handbooks for Pantex and Nevada. • DOE-DP-STD-3016-99, Hazard Analysis Reports for Nuclear Explosive Operations. Such directives, when incorporated into a contract, establish the processes and expectations for contractor performance of hazards analyses. Note that, in addition, DOE has developed proposed regulations that correspond to existing DOE nuclear safety Orders. These proposed rules remain compatible with the ISMS and provide for implementation into ISMSs.

Requirements for hazards analyses to be performed to adequately protect the worker, the public, and the environment can also be found as statutory and regulatory requirements. Examples include 29 CFR 1910, 29 CFR 1926, 10 CFR 71, and 10 CFR 1021. Unless a DOE or contractor activity is specifically exempted or waived, such regulatory requirements are mandatory (see Attachment 5). For decommissioning activities, 29 CFR 1910.120 and 29 CFR 1926.65 can be used to analyze hazards. For environmental remediation and decommissioning hazardous waste work, the HAZWOPER requirements of 29 CFR 1910.120 and 1926.63 may be applied for hazard characterization. EWP applications have yielded tools that can aid integration of hazards identification analysis and control, such as the “Automated Job Hazard Analysis” (AJHA) used at Project Hanford. The AJHA integrates hazards related to radiological protection, industrial safety and hygiene, environmental compliance, fire protection, and nuclear safety. More information on these tools is available at the following web site: http://tis-nt.eh.doe.gov/WPPHM/ewp/Ewp2.htm. CANCELE D http://tis-nt.eh.doe.gov/WPPHM/ewp/Ewp2.htm. Page 36 - Integrated Safety Management System Guide - Volume 1 5-27-99 Chapter II DOE G 450.4-1A In addition, Pollution Prevention Opportunity Assessments (PPOAs) can be used to— • identify the nature and amounts of waste, releases and emissions, and energy usage resulting from processes and projects within a site’s operation; • identify the opportunities for pollution prevention and energy conservation; and • evaluate those opportunities for feasible implementation. Regardless of the specific requirements and methods calling for different types of hazard analysis, each analysis should depend and build upon the others. In this way, activity hazard analyses can be totally integrated with site- and facility-level analyses (i.e., detailed hazard analyses performed for a specific work task may take into account the impact of the work on other areas of the site or facility, as well as how facility and site hazards affect the work task). All types and levels of hazard analysis should provide for worker input to the process. Facility workers are often the most knowledgeable regarding work conditions and associated hazards. Worker involvement as members of the planning team is particularly important when performing job hazards analysis because this process focuses specifically on a worker’s interactions with hazards during the course of job duties. For more information on worker involvement in job hazard analysis and control of hazardous exposures, see DOE G 440.1-3, OCCUPATIONAL EXPOSURE ASSESSMENT. As with all other aspects of the work, the level of management involvement in reviewing and approving the hazard analysis should be commensurate with the complexity of the work and the hazards entailed. For example, activities involving nuclear hazards (e.g., Hazard Category 1, 2, and 3 nuclear facilities, as defined by DOE-STD-1027) may require DOE to review and approve the hazard analysis. Such categorizing of facilities will aid in tailoring the DOE requirements and expectations to the work and hazards. Many DOE Orders use the hazard category to include or exclude specific requirements. For example, DOE 5480.23 for nuclear facilities excludes the requirement to address inadvertent criticality for Hazard Category 3 facilities as defined in DOE-STD-1027 because such facilities do not contain sufficient fissile materials to present a criticality hazard. Similarly, the hazard category plays a significant role in DOE O 420.1, FACILITY SAFETY, relative to establishing seismic design requirements and seismic analysis requirements.

Regulatory and contractual requirements applicable to the work (i.e., the set of safety standards and requirements) and the complexity and hazard of the work (i.e., scope of work) will dictate the methods used by a contractor to analyze hazards. This illustrates the importance of the relationship between the core functions of defining the scope of work and analyzing hazards, which lead to Core Function 3, Develop and Implement Controls. CANCELE D Volume 1 - Integrated Safety Management System Guide - Page 37 Chapter II 5-27-99 DOE G 450.4-1A 4. CORE FUNCTION 3, DEVELOP/IMPLEMENT CONTROLS; GUIDING PRINCIPLE 5, IDENTIFICATION OF SAFETY STANDARDS AND REQUIREMENTS; AND GUIDING PRINCIPLE 6, HAZARD CONTROLS TAILORED TO WORK BEING PERFORMED 4.1 Identification of Appropriate Standards The terms and conditions that define DOE safety expectations for its contractors are set forth as contract requirements. DEAR 970.5204-78 requires the contractor to comply with the requirements of applicable Federal, State, and local laws and regulations (including DOE Regulations) in developing and implementing controls, unless the appropriate regulatory agency has granted relief in writing. DOE has identified safety requirements in Rules and DOE Orders and has developed a wide variety of associated Technical Standards, Guides, and Manuals; in addition, DOE encourages the use of national consensus technical standards. In addition to complying with the requirements of applicable Federal, State, and local laws and regulations (including DOE Regulations) in developing and implementing controls, as required by DEAR 970.5204-78(a) (List A), the contractor must comply with the requirements of applicable DOE directives appended to the contract [List B at DEAR 970.5204-78(b)]. ES&H requirements appropriate for work conducted by a contractor may be determined using a DOE-approved process to (1) evaluate the work and the associated hazards and (2) identify an appropriately tailored set of standards, practices, and controls. When such a process is used, the set of tailored ES&H requirements must be reviewed for adequacy and approved by the CO. The approved set shall be incorporated into List B as contract requirements with full force and effect. These approved processes may also be used to identify standards that are specific to facilities or activities and are generally, but not necessarily, a subset of List A and List B. Approved processes for establishing ES&H requirements include the following: • incorporation of a Standards/Requirements Identification Document (S/RID) into the contract (per 90-2 Implementation Plan, Rev. 5); • use of the Work Smart Standards Processes (DOE M 450.3-1, THE DEPARTMENT OF ENERGY CLOSURE PROCESS FOR NECESSARY AND SUFFICIENT SETS OF STANDARDS); and • compliance with DOE directives and other applicable laws and regulations. Once DOE has agreed to the sitewide ES&H requirements established by the contractor, those requirements are implemented by the contractors’ manuals of practice. Figure 4b illustrates how ES&H requirements flow down, through contractual requirements, to the contractor’s safety CANCELE D Page 38 - Integrated Safety Management System Guide - Volume 1 5-27-99 Chapter II DOE G 450.4-1A

management program (implemented in manuals of practice) and are applied to facility, activity, or task work. DOE approval of the contractor’s ISMS description and oversight of its implementation are fundamental to the Department in satisfying its own responsibilities for ensuring safety. Operation-specific controls, tailored to the hazards, to be mutually agreed upon by DOE and the contractor, become contractual terms and conditions for performing the work. Before work is performed, appropriate controls are developed and an applicable set of safety standards and requirements identified. These safety standards and requirements may be from List A or List B, or they may be a tailored set of standards derived from List B or other sources. Developing and implementing hazard controls at the site or facility level includes– • identifying applicable standards and agreed-upon sets of requirements (to the extent that appropriate requirements have not already been identified in the contractor’s manuals of practice), • identifying controls including pollution prevention options to prevent/mitigate hazards, • establishing boundaries for safe operations (establishing a safety envelope), and • implementing and maintaining configuration of controls [e.g., technical safety requirements (TSRs) and operational safety requirements]. Specific controls needed at the activity level are developed using the results of activity hazard analysis. For hazards that have been included in the sitewide analyses, the applicable standards are included in lists A and B. However, facility-level and activity-level hazards analysis may also identify new hazards or unanalyzed conditions for existing hazards that require unique activity- specific controls be placed in the corporate manuals of practice or the authorization agreement if one is needed for the project or facility. The hierarchy of controls (i.e., engineering, administrative, and personal protective equipment) used at this level is the same as that used at higher management levels, which are applied in a risk-based manner. The controls developed, implemented, and maintained should be integrated with other controls and commitments, particularly those in sitewide safety programs, such as fire protection and radiation protection (See Figure 4a). In general, the use of administrative controls to address each hazard should be minimized where the effectiveness and value of engineering controls can be demonstrated. Although identification of standards is discussed here, as part of Core Function 3, Develop/Implement Controls, standards identification may also occur during activities that define the scope of work, analyze hazards, or provide feedback and improvement. 4.2 Sitewide Requirements A multidisciplinary hazard analysis team composed of line management, health and safety professionals, and workers should tailor the set of standards that apply to the work at each CANCELE D Volume 1 - Integrated Safety Management System Guide - Page 39 Chapter II 5-27-99 DOE G 450.4-1A

management level. These standards should be commensurate with the hazards involved, per Guiding Principle 5. To achieve this objective, DOE and contractor line management identify laws, statutes, and Federal regulations that apply. Such requirements are generally mandatory and non-discretionary for DOE and the contractor, although exemptions may be obtained when necessary. DOE and contractor line management should establish (through the contract) any additional requirements necessary to ensure adequate safety. These requirements may be derived from DOE directives, DOE Technical Standards, or national consensus standards. Whatever the approach, both DOE and contractor line management should review and concur on the set of standards and requirements selected. The CO is responsible for ensuring that the set of requirements selected is sufficient to achieve an adequate level of safety. 4.3 Facility-Specific Requirements [Identification of Appropriate Controls] The ISMS should have a process to identify engineering, administrative, and personal protective equipment controls and pollution prevention/waste minimization options imposed on the work, as derived from the agreed-upon set of standards and requirements. As with the set of standards and requirements, the derived controls should be tailored to the work and the associated hazards, in accordance with Guiding Principle 6. The controls should encompass all aspects of the work (including potential abnormal or emergency situations) and each phase of work performance (e.g., preparation, review, authorization, and execution). Emphasis should be on designing the work and/or controls to reduce or eliminate the hazards and to prevent accidents and unplanned releases and exposures [DEAR 48 CFR 970.5204-2(b)(6)]. Controls should be developed systematically at each management level, addressing all relevant functional areas or disciplines of concern (e.g., quality assurance, fire protection, industrial safety, radiological protection, emergency preparedness, criticality safety, maintenance). The information developed for controls at each management level should be used as the basis for the next-lower level of controls (i.e., site controls should be integrated with facility controls, which should be integrated with the controls applied to work at the task level). The EWP process relies on a work planning team that includes subject matter experts to specify the controls for the task/activity level of work. Controls should use inherently safe design aspects and should be based on defense-in- depth considerations. (DOE-STD-3009 provides relevant guidance for nuclear facilities.) Such controls should address preventive and mitigative considerations, passive and active aspects, and automatic versus manual operating needs. DOE 5480.23 and DOE 5480.22, and corresponding DOE-STD-3009 provide guidance for nuclear facilities on establishing documented safety limits, limiting control settings, and limiting conditions for operation, surveillance requirements, administrative controls, and design features that result from a disciplined safety analysis. DOE 5481.1B contained requirements and guidance for non- CANCELE D Page 40 - Integrated Safety Management System Guide - Volume 1 5-27-99 Chapter II DOE G 450.4-1A Figure 4b. An illustration (derived from Tech-16) of the facility or activity level implementation of ES&H requirements in a standards-based ISMS. CANCELE D

Volume 1 - Integrated Safety Management System Guide - Page 41 Chapter II 5-27-99 DOE G 450.4-1A nuclear facilities. The following directives provide additional information for DOE weapons facilities: • DOE O 452.1A, NUCLEAR EXPLOSIVE AND WEAPON SURETY; • DOE G 452.2A-1A, IMPLEMENTATION GUIDE FOR DOE ORDER 452.2A, SAFETY OF NUCLEAR EXPLOSIVE OPERATIONS; and • DOE O 452.2A, SAFETY OF NUCLEAR EXPLOSIVE OPERATIONS. Specific controls derived from the agreed-upon set of standards and requirements may take several forms: engineered controls, written procedures, or other administrative controls. The form selected should be tailored to the hazard or importance of the desired attribute and, again, should be determined by line management responsible for the work based on safety/hazard analyses. The knowledge, skills, and abilities of the work force should be considered when selecting the form of controls. DOE and contractor agreement on the safety envelope is required as a condition for authorizing operations to proceed. Figure 5 shows the interconnection of DOE Rules and Orders that may be used to establish the safety envelope for nuclear facilities. Once a set of controls has been established, processes should be provided for maintaining work performance within the safety envelope established in the safety/hazard analysis. The processes should clearly identify the controls used to establish the safety envelope. Some contractors achieve this objective by using work packages, job plans, maintenance plans, and TSRs (nuclear facilities). A process to review, approve, and provide change control of the safety envelope should exist. 4.4 Worker Protection DOE O 440.1A requires DOE elements and contractors to implement a written worker protection program that describes an integrated management organization and support systems that fully satisfy DOE worker protection requirements of all technical disciplines. DOE O 440.1A also requires that workers be allowed, through their supervisors, to stop work when they discover conditions that may expose them to imminent danger or other serious hazards. The stop-work procedure should be exercised in a justifiable and responsible manner. DOE elements and contractors should establish procedures that address stop-work authority and ensure that workers are trained in those procedures. DOE and contractor line organizations should assign and communicate worker protection responsibilities to workers, ensuring that they have adequate authority and resources to carry out those responsibilities. Line management should encourage and promote employee involvement and commitment. An important component of employee involvement is the establishment of CANCELE D Page 42 - Integrated Safety Management System Guide - Volume 1 5-27-99 Chapter II DOE G 450.4-1A Figure 5. An illustration (derived from Tech-16) of applicable ES&H requirements at various organizational levels for a Hazard Category 2 nuclear facility. CANCELE D Volume 1 - Integrated Safety Management System Guide - Page 43 Chapter II 5-27-99 DOE G 450.4-1A worker protection committees to promote employee participation in developing program goals, objectives, and performance measures and identifying and correcting workplace hazards. Employees should also be encouraged to perform informal worksite inspections as part of their daily work. For inspections to be effective, employees should be trained in hazard recognition, have access to worker protection professionals and reference sources (DOE requirements, guides, technical standards, etc.), and be knowledgeable enough to suggest and track corrective actions.

5. CORE FUNCTION 4, PERFORM WORK, AND GUIDING PRINCIPLE 7, OPERATIONS AUTHORIZATION DOE and the contractor identify and implement safety controls BEFORE starting to work. Once work begins, it is performed in accordance with those safety controls. Accordingly, each contractor’s ISMS should have a process to confirm adequate preparation, including adequacy of controls, prior to authorizing work to begin at the facility, project, or activity level. DEAR 970.5204-2(b)(7) requires that DOE and the contractor establish and agree upon the conditions and requirements to be satisfied for operations to be initiated and conducted. These conditions and requirements are included in the contract and are therefore binding upon the contractor. The formality and rigor of the review process and the extent of documentation and level of authority for agreement should be based on the hazard and complexity of the work being performed. The process should ensure programs addressing all applicable functional areas are adequately implemented to support safe performance of the work. DOE O 425.1, STARTUP AND RESTART OF NUCLEAR FACILITIES, provides readiness guidance for nuclear facilities. The requirement for an independent assessment or DOE review should be established within the set of agreed-upon standards and requirements established for the scope of work. Internal or external oversight groups, review teams, and audit organizations should evaluate the process to identify and correct deficiencies. The process should ensure corrective actions are effective in establishing a state of readiness. Examples of methods used by DOE and contractors to confirm readiness include readiness assessments, operational readiness reviews (ORRs), and Title III inspections (project design). Guiding Principle 7 and the DEAR require conditions to be satisfied and established for operations to be initiated and operated. These agreed-upon conditions and requirements are requirements of the contract and binding upon the contractor. The extent of documentation and level of authority for agreement shall be tailored to the complexity and hazards associated with the work and shall be established in a Safety Management System [48 CFR 970.5204(b)(7)]. The QA Rule, 10 CFR 830.120, and DOE O 414.1 require that work be performed to established technical standards and controls. For certain sitewide systems and activities, such as fire CANCELE D Page 44 - Integrated Safety Management System Guide - Volume 1 5-27-99 Chapter II DOE G 450.4-1A protection, emergency planning, and operator training, readiness may be confirmed periodically. The following provide guidance for sitewide programs involving nuclear operations: • DOE 5480.20A, PERSONNEL SELECTION, QUALIFICATION, AND TRAINING REQUIREMENTS FOR DOE NUCLEAR FACILITIES; • DOE O 420.1, FACILITY SAFETY; • DOE O 460.1A, PACKAGING AND TRANSPORTATION SAFETY; and • 10 CFR 835, RADIATION PROTECTION FOR OCCUPATIONAL WORKERS. For nuclear facilities, DOE 5480.23 requires the development and description of– • facility initial testing programs; • facility in-service surveillance programs; • facility maintenance programs based on DOE 4330.4B, MAINTENANCE MANAGEMENT PROGRAM; • conduct of operations programs that define worker communications; and • activities based on DOE 5480.19, CONDUCT OF OPERATIONS REQUIREMENTS FOR DOE FACILITIES. DOE O 430.1A, LIFE-CYCLE ASSET MANAGEMENT, provides similar requirements for non- nuclear facilities.

The ISMS should ensure that safety control measures that have been mutually agreed upon are integrated into work performance and that– • personnel are responsible and accountable for performance of work in accordance with the controls established; • the controls are adequate to ensure safe work performance and to prevent accidents, uncontrolled releases, or unacceptable exposures to hazardous materials; • the controls established for safety are a discernible part of the plan for work; and • the necessary safety support functions and interfaces required (e.g., training, maintenance, radiological protection, etc.) have been established. CANCELE D Volume 1 - Integrated Safety Management System Guide - Page 45 Chapter II 5-27-99 DOE G 450.4-1A For nuclear facilities, DOE 5480.23 requires appropriate consideration of conduct of operations, emergency preparedness, fire protection, etc. Typically, contractors use a system of written policies, manuals, and procedures to ensure safety controls are integrated into work plans. At the work level, consideration must be given to controls necessary for worker protection. Individual work plans, operating procedures, and maintenance procedures are often used to implement safety controls at the task level. The following should be factored into the selection of worker safety controls: • hands-on training, safety awareness training, and the identification of necessary personal protective equipment (PPE), which are vital in familiarizing a worker with job duties, hazards, and controls; • pre-job briefings and walkdowns, which provide a good opportunity to ensure workers are aware of hazards and knowledgeable on the proper use of prescribed controls; and • worker input, which should be solicited because workers can offer creative solutions for controlling hazards in a safe yet practical and cost effective manner. It is also important to keep in mind that some PPE may create a hazard. The ISMS should also include a process to identify performance measures, including safety performance measures for the work as required by DEAR 48 CFR 970.1001 (see Attachment 5). 5.1 Authorizing Work DOE and the contractor should formally agree on the need for authorization agreements for those nuclear and significant hazard facilities that must perform work safely without any undue risk to the worker, the public, and the environment. The contractor’s ISMS description should clearly identify the roles of the contractor and DOE in authorizing work at appropriate levels. Understanding DOE and contractor roles with respect to authorizing work and changes to the work is essential for successful implementation of the ISMS. The following discussion on authorization protocol and authorization agreements provides elementary information and guidance for consideration in the development of contractor ISMSs. 5.1.1 Authorization Protocol The DOE FRAM defines authorization protocols as– Those processes used to communicate acceptance of the contractor’s integrated plans for hazardous work. Such protocols are expected to range from preperformance review and approval by DOE of detailed safety-related terms and conditions for performing work (authorization agreement) to less rigorous oversight and postperformance assessment of the contractor’s work. CANCELE D Page 46 - Integrated Safety Management System Guide - Volume 1 5-27-99 Chapter II DOE G 450.4-1A

These protocols should be clearly delineated in the contractor’s ISMS description and should clarify the understanding and agreements between the contractor and the Department in performing hazardous work. 5.1.2 Authorization Agreement An authorization agreement is a contractually binding agreement between DOE and the contractor for predetermined hazardous facilities, tasks, or activities. The DOE FRAM defines an authorization agreement as– A documented agreement between DOE and the contractor for high-hazard facilities (Category 1 and 2), incorporating the results of DOE’s review of the contractor’s proposed authorization basis for a defined scope of work. The authorization agreement contains key terms and conditions (controls and commitments) under which the contractor is authorized to perform the work. Any changes to these terms and conditions would require DOE approval. The need for an authorization agreement will depend on the organization and adequacy of the existing, contractually binding documentation containing key terms and conditions. For example, at sites or facilities that have S/RIDs in place, it would be undesirable to duplicate the S/RID commitments in an authorization agreement. If an authorization agreement were required, it could simply reference the S/RIDs. The Department and the contractor should ensure that the ISMS includes procedural mechanisms that trigger a review to determine the necessity of having, revising, or eliminating an authorization agreement. The authorization agreement may serve a number of purposes: • To incorporate the results of DOE’s review of the contractor’s proposed authorization basis for a defined scope of work. • To define key terms and conditions (controls and commitments) under which the contractor is authorized to perform work; these key terms and conditions must be clearly identified in the agreement and any changes to these key terms and conditions would require DOE approval. • To delineate the key references DOE will approve versus that information that will simply be reviewed for information. (The ISMS description may also serve this function.) • To consolidate the basis for a DOE determination to authorize operations by combining key DOE and contractor authorization basis and assessment documentation into one document. CANCELE D Volume 1 - Integrated Safety Management System Guide - Page 47 Chapter II 5-27-99 DOE G 450.4-1A • To minimize the amount of correspondence required between the contractor and the Department when agreements for routine tasks and activities, requiring approval at certain unique facilities, can be approved once. Authorization agreements have also proved beneficial to DOE and contractors for facilities being affected by significant changes in mission, those requiring significant upgrade for their authorization bases, and those undergoing decontamination and decommissioning. 5.2 Sample Format and Content for Authorization Agreements The following sample format and content may be useful for documenting an authorization agreement. Like the numerous and varied Nuclear Regulatory Commission licenses, the format and content of agreements are likely to differ because of the unique and diverse facilities and activities in the complex. The authorization agreement establishes agreed-upon operating boundaries for conducting hazardous work by defining key terms and conditions for both DOE and the contractor. 1. Scope of the Agreement

This section should clearly describe the work being authorized and the facility or facilities where the work is to be performed. It should be consistent with the work analyzed in the authorization basis and the controls established. 2. DOE Basis for Approval This section should include the basis for DOE approval to perform the work and the basis for its conclusion that the work defined in the agreement can be performed without undue risk to the worker, the public, and the environment. This section should include the key reviews and assessments that form the basis of DOE approval. Typical examples include DOE issuance of a SAR; review and approval of a SAR; reviews and approvals of TSRs, ORRs, or assessments; approval of the list of requirements required by the DEAR laws clause; and approval of the contractor’s ISMS description in accordance with the DEAR ES&H clause. 3. Listing of Documents that Constitute the Authorization Basis This section should include a summary listing of key documents such as SARs, the basis for interim operation, NEPA documentation including EIS, environmental permits, etc. CANCELE D Page 48 - Integrated Safety Management System Guide - Volume 1 5-27-99 Chapter II DOE G 450.4-1A 4. Terms and Conditions This section should specify contractor commitments for assuring DOE that the authorized work will be performed safely. The process to be used to keep the authorization agreement current should be described. Key terms and conditions requiring DOE review and approval need to be clearly identified in this section. This may include specific implementation procedures or manuals of practice. Other terms and conditions may only require DOE notification and review if deemed appropriate. Examples of terms and conditions include the following: • Controls identified in TSRs or TSR-like documents. Such controls would include controls established from hazard analyses and those derived from contractual requirements (i.e., List A and B from the DEAR laws clause). • Commitments to a configuration management program including an unreviewed safety question (USQ) or USQ-like process. • Commitments to a process for reporting noncompliances with established controls or terms of the authorization agreement. This process would include any special actions to be taken if an unplanned event were to occur. NOTE: Authorization agreements should be carefully written to avoid the need for revision whenever a key reference is updated. It is necessary for the referenced documents, or key conditions and commitments in these documents, to be contractually binding and under configuration control without the need to change the authorization agreement whenever a reference changes. The title and number of referenced documents should be listed. Revisions should be indicated by the words “as amended” or “latest revision” to indicate those documents can change without having to amend the authorization agreement for each revision. For existing facilities with older revisions that predate the first authorization agreement, a method to indicate the subsequent revisions might include “Rev. X or higher.” For sites or facilities with S/RIDs in place, it will be wise to avoid duplication in the authorization agreement with certain conditions already specified and agreed upon in the S/RID. For example, it is quite appropriate for the agreement to simply state that operating in accordance with the S/RID is required. In such an instance, the S/RID is the agreement where the particular Emergency Preparedness Program, Fire Protection Program, AB Documentation (including USQ), and other such requirements are located.

5. Contractor Qualification This section should make a positive statement about DOE’s confidence in the contractor’s ability to safely perform the work identified in the agreement. CANCELE D Volume 1 - Integrated Safety Management System Guide - Page 49 Chapter II 5-27-99 DOE G 450.4-1A 6. Special Conditions This section should cover any other special conditions that DOE wants to make contractually binding. Such conditions may include aspects of environmental management, safeguards and security, and protection of property. 7. Effective Date and Expiration Date (if it is to expire) This section would include the duration of the agreement and when it will be renegotiated, reviewed, or extended. 8. Statement of Agreement This section would include signatures of the agreeing parties (DOE manager and contractor manager) and dates with the typed names below the signature line. 9. Exceptions (if required) This section would identify any specific exceptions or unusual circumstances that should be noted. For example, at Rocky Flats, authorization agreements might address appropriate liability and the understanding between DOE and the new contractor regarding less than fully analyzed bases for controls. EXAMPLES: Examples of executed authorization agreements will be placed on the ISM home page (http://tis-nt.eh.doe.gov/ism). These examples are for information only and should not be interpreted as the only way to develop these agreements. Questions should be directed to the agreement originator or to the Director, Safety Management Implementation Team. 6. CORE FUNCTION 5, FEEDBACK/IMPROVEMENT Work processes and organizational safety management performance should be routinely measured and evaluated to identify information that is meaningful to line management. Line management is directly responsible for establishing and implementing programs and processes to generate feedback. Using this feedback, line management can then confirm safe performance of the work and effective implementation of the ISMS, and identify opportunities for improvement. These evaluations use quantitative and/or qualitative information from a variety of sources (e.g., in- process monitoring, performance indicators, occurrence reports, trending, statistical analysis, management assessments, independent assessments, and workers, customers, suppliers, regulators, and stakeholders). Workers can contribute significantly to the feedback and improvement function at the task/activity level due to their knowledge of the work process. Identified improvement actions should be shared with similar organizations and tracked by CANCELE D http://tis-nt.eh.doe.gov/ism Page 50 - Integrated Safety Management System Guide - Volume 1 5-27-99 Chapter II DOE G 450.4-1A management to determine whether they are yielding the anticipated improvements. A key component of the assessment process is an effective tracking and follow-up system. Many contractors and DOE elements have found it useful to have an electronic database to continuously update the prioritized list of improvements and corrections and to track their resolution. Additional information on the assessment process is being developed as part of the response to the Defense Board Recommendation 98-1.

DOE elements are also required to develop and implement assessment programs. The QA Order, DOE O 414.1, requires DOE elements to assess their internal performance and that of their contractors (suppliers) by performing management and independent assessments. DOE P 450.5, LINE ENVIRONMENT, SAFETY AND HEALTH OVERSIGHT, establishes expectations for coordinating DOE line management oversight of their contractors. DOE P 450.5 also describes the necessity of contractors having robust, rigorous, and credible assessment programs to facilitate DOE line management oversight. Appendix D provides guidance for assessment programs that contribute to the integration of safety management with mission accomplishment, while giving line management maximum flexibility in program design. This guidance includes references to DOE and national standards for assessment programs, the use of the other feedback and improvement elements (e.g., performance indicators), and the assessment of specific safety programs and hazard controls (e.g., conduct of operations). DOE has developed following guidance for implementing an assessment program that helps integrate safety management with mission accomplishment, while giving line management maximum flexibility in program design: • DOE G 414.1-1, IMPLEMENTATION GUIDE FOR USE WITH INDEPENDENT AND MANAGEMENT ASSESSMENT REQUIREMENTS OF 10 CFR PART 830.120 AND DOE 5700.6C, QUALITY ASSURANCE; • DOE M 231.1-1: ENVIRONMENT, SAFETY AND HEALTH REPORTING MANUAL; and • DOE G 450.3-4, ASSESSMENT. This guidance includes references to DOE and national standards for assessment programs, guidance in using the other feedback and improvement elements (e.g., performance indicators), and guidance in assessing specific safety programs and hazard controls (e.g., conduct of operations). General guidance on assessment programs is provided in Appendix D of Volume 2. Additional information is being developed as part of the response to Defense Board Recommendation 98-1. CANCELE D Volume 1 - Integrated Safety Management System Guide - Page 51 Chapter II 5-27-99 DOE G 450.4-1A Another aspect of performance assessment is through “real-time” feedback provided by workers. This can include informal, verbal feedback provided on the job site, or more formal mechanisms, such as employee suggestion programs and post-job reviews and assessments. Integration of these activities into the feedback and improvement programs will help ensure that safety or other work-related issues are identified expeditiously. Communicating the results of all levels of assessments upward in the contractor organization allows the findings to reach the management level with the authority necessary to effect improvements. DEAR 970.5204-2(c)(5) requires the contractor to provide feedback on the adequacy of controls and continue to improve safety management. Managers perform assessments to evaluate their management processes to identify and correct problems that hinder the organization from achieving its objectives. Applied at the institutional level, executive/senior management determines whether the ISMS reflects how the corporation does work safely. To make this determination, these senior managers rely in part on the assessment results from facility managers and the institutional-level independent assessment body reporting to them.

Management at the facility level assesses issues more closely related to operational safety performance. Such issues include determining that core safety functions have been applied to all normal/planned operations expected in the facility and that the guiding safety principles are applied to daily operations. It should also include observation and measurement of worker behavior while performing work. Management assessments at the facility level can make extensive use of various forms of feedback data (e.g., data obtained in accordance with DOE O 232.1, OCCURRENCE REPORTING AND PROCESSING OF OPERATIONS INFORMATION) to plan and scope the assessment. A team comprised of facility and support services managers may be formed to evaluate shared/cross-cutting safety programs provided at the institutional/site level. This approach teams those managers and staff most knowledgeable about the shared program’s capabilities with those who rely on those safety features. Together, they can identify significant performance issues and improvements. To be free to focus on performance issues, facility-level management must be assured that workers (and first-line supervisors) are competent to routinely assess basic compliance with operating procedures that include hazard controls. A well-integrated assessment program gives contractor senior management confidence in the effectiveness of the institutional ISMS. Another benefit of a comprehensive assessment program is to increase DOE line management and independent oversight organizations’ confidence in the contractor’s ability to perform the feedback and improvement function. Increased confidence can reduce the level of DOE line management oversight and mitigate Price-Anderson Amendments Act (PAAA) enforcement penalties. CANCELE D Page 52 - Integrated Safety Management System Guide - Volume 1 5-27-99 Chapter III DOE G 450.4-1A CHAPTER III ISMS DEVELOPMENT, IMPLEMENTATION, REVIEW, AND APPROVAL This chapter provides guidance on development, implementation, review, and approval of an ISMS. This guidance is based on the SMS Policies, the DEAR, the FRAM, and experience obtained during ISMS implementation activities at various facilities. 1. BACKGROUND The DEAR ES&H clause [48 CFR 970.5204-2(b)(6)] requires the contractor to document its ISMS and submit that documentation to the CO for review and approval. In addition, the FRAM requires the Head of the Contracting Activity (HCA) to approve the safety management descriptions. (Note that although the FRAM identifies the requirement for DOE approval of “safety management descriptions,” the review and approval process currently being used seeks to obtain information to support approval of the documented ISMS.) The following guidance has been developed to assist both DOE and contractors in developing, implementing, and describing their ISMSs to satisfy the requirements of the ISMS Policies, DOE P 450.4 (Attachment 1), DOE P 450.5 (Attachment 2), DOE P 450.6 (Attachment 3), DOE P 411.1 (Attachment 4), and the DEAR, 48 CFR Chapter 9 (Attachment 5). This guidance will also be useful to the DOE line manager responsible for reviewing the contractor’s ISMS and ensuring it is incorporated into the contract. This guidance is based on a number of documents, including those identified above and the FRAM, and experience with using the Draft Integrated Safety Management System Verification Process, Team Leader’s Handbook (DOE-SAFT-0065). Appendix E provides a general summary of the review and approval process based on experience acquired to date. This experience has primarily been gained from Defense Program facilities but has included some Environmental Management and Energy Research facilities with nuclear hazards.

The guidance provided here emphasizes the need for the contractor to satisfy requirements in the DEAR. In addition, for the ISMS to be effective, contractor and DOE field organizations must integrate the contractor’s ISMS with DOE ISMS requirements outlined in the FRAM. The HCA and the DOE review staff (e.g., budget specialists, environmental, safety, and health professionals, and other technical personnel) should use the expectations in Sections 2, 3, and 4 of this chapter when reviewing the contractor’s ISMS documentation. This chapter provides a set of expectations and attributes that the HCA or other review personnel can use during contract preparations to focus discussions on the ISMS guiding principles and core functions necessary to achieve an ISMS. Contractors should use the discussion of these expectations and attributes to develop and implement ISMSs that integrate appropriate contractor CANCELE D Volume 1 - Integrated Safety Management System Guide - Page 53 Chapter III 5-27-99 DOE G 450.4-1A programs, procedures, controls, and initiatives affecting safety. In addition, this chapter discusses the importance of the FRAM and FRAs for DOE Headquarters and field elements. These documents, among other things, identify the DOE Headquarters and field element roles in ensuring that integrated safety management is implemented on a continuing basis. 2. DEVELOPMENT 2.1 DOE Development Most DOE requirements for developing and maintaining the ISMS are detailed in the FRAM and the FRA documents being developed. This section highlights many important DOE functions in the FRAM necessary for development of an ISMS. 2.1.1 Core Function 1, Define Scope of Work a. Translate Mission into Work (FRAM 9.2.1). Section 9.2.1 of the FRAM requires each field element to develop appropriate documents delineating its plan of work, including scope, schedule, and funding allocations for each fiscal year. b. Set Expectations (FRAM 9.2.2). Section 9.2.2 of the FRAM contains several subsections that address the processes involved in establishing expectations: • 9.2.2.1 Policies, Orders, Notices, Manuals, and Guides; • 9.2.2.2 Technical Standards for Use Within DOE; • 9.2.2.3 Rules; • 9.2.2.4 Contract Expectations; • 9.2.2.5 Organization Functions, Responsibilities, and Authorities Manuals; and • 9.2.2.6 Approval of Safety Management Systems Documentation. These subsections define the many functions, authorities, and responsibilities of DOE Headquarters and field element line management related to the development of an ISMS. Some of these subsections merit additional descriptions. Section 9.2.2.1 requires the CO to negotiate with each contractor, in consultation with the FEM and CSO, to establish which directives or provisions of directives, if any, are to be included in the contract. This section also requires the FEM to develop and maintain CANCELE D Page 54 - Integrated Safety Management System Guide - Volume 1 5-27-99 Chapter III DOE G 450.4-1A controls to identify the directives or directives provisions applicable to the field organization and to incorporate such provisions into the field’s management systems.

Section 9.2.2.4 requires the CSO to provide guidance to FEMs on expected performance, to set goals and priorities, and to allocate resources. This section also requires the FEM to ensure that contracts establish clear expectations and work performance measures and to ensure the contracts define the actions necessary to meet site mission and safety expectations. Section 9.2.2.4 also requires the CO to approve and issue contracts that meet contract regulations and provide clear expectations and performance measures to contractors regarding work to be performed and the mission and safety requirements. The CO must also ensure contracts clearly delineate contractor responsibilities regarding subcontractors and suppliers. Section 9.2.2.6 requires the HCA to approve ISMS descriptions and revisions. Section 9.2.2.6 also requires the HCA to determine the need for the team to review the safety management description. If a team review is needed, the HCA selects members of the review team for specific applications and the team leader from the approved list of senior technical managers provided by the Deputy Secretary. (The CSO, FEM, and EH provide input to the Deputy Secretary in developing and approving this List.) c. Provide for Integration (FRAM 9.2.2.5). Section 9.2.2.5 of the FRAM specifies requirements for lower-tier FRA documents to provide details of the functions, responsibilities, and authorities of DOE Headquarters and field elements necessary to integrate SMSs. d. Prioritize Tasks and Allocate Resources (FRAM 9.2.3 and 9.2.4). Section 9.2.3 of the FRAM requires the CSO and the FEM to prepare budget execution guidance in accordance with the DEAR, DOE O 135.1, and DOE M 135.1-1 to allocate resources to contractors and to ensure that funds and resources are appropriately used. Section 9.2.4 requires the CSO to ensure that the ISMS adequately prioritizes work to ensure that mission and safety expectations for the site are met within available budget and resources. Section 9.2.4 also requires the FEM to review and support development of expected performance objectives and related CSO goals and priorities. Section 9.2.4 requires the CSO to review and provide guidance to the FEM regarding the ISMS and its ability to ensure that mission and safety objectives can be met within budget constraints. CANCELE D Volume 1 - Integrated Safety Management System Guide - Page 55 Chapter III 5-27-99 DOE G 450.4-1A The DOE CSOs and field elements are developing FRAs to translate the FRAM requirements into requirements specific to their scope of work. These important actions are going on in parallel with the review and approval of contractor ISMSs and should focus on the above FRAM sections. 2.2 Contractor Actions to Develop an ISMS 2.2.1 Evaluation of Existing Systems The existing ISMSs used by DOE and its contractors include a number of sound procedures and manuals of practice that have been proven over many years. It is not the intention of the DEAR clauses in Attachment 5 to change these proven safety practices. The objective is instead to improve the integration of these practices and ensure that the seven ISMS principles and five core functions provide the foundation for safety management practices.

Experience has demonstrated the value of reviewing the existing procedures and manuals of practice prior to instituting any changes or attempting to describe how the existing ISMS satisfies the DEAR requirements. The contractor should first identify the complete set of safety programs at the facility or site. These programs are typically described in facility- or sitewide policy statements and are implemented through the use of facility- or sitewide procedures and/or manuals of practice. The following procedures and programs should be identified as part of this initial effort: • work definition and planning; • hazards identification and analysis; • definition and implementation of hazards controls; • development and implementation of operating procedures; • performance of work; and • monitoring and assessment of performance for improvement. Subsequently, the facility- or operation-specific manuals of practice should also be identified for major facilities with procedures and practices unique to their operations. Preparing a matrix similar to the one shown in Figure 6 can help with the analysis of how well these programs meet the functions and principles of ISMS. More of these matrixes may be required to address the sitewide and facility-specific procedures and practices. When properly filled in, a matrix of this type can help analyze the completeness of the ISMS. CANCELE D Page 56 - Integrated Safety Management System Guide - Volume 1 5-27-99 Chapter III DOE G 450.4-1A G ui di ng P ri nc ip le s C or e F un ct io ns L in e M gm t R es po ns ib le fo r Sa fe ty C le ar R ol es & R es po ns ib ili ti es C om pe te nc e C om m en su ra te w it h R es po ns ib ili ty B al an ce d P ri or it ie s ID o f Sa fe ty St an da rd s & R eq ui re m en ts H az ar ds C on tr ol s T ai lo re d to W or k O pe ra ti on s A ut ho ri za ti on D ef in e Sc op e A na ly ze H az ar ds D ev el op & Im pl em en t C on tr ol s L is t a pp lic ab le pr oc ed ur es a nd m an ua ls o f p ra ct ic e P er fo rm W or k F ee db ac k & C on ti nu ou s Im pr ov em en t F ig ur e 6. M at ri x fo r U se in R ev ie w o f E xi st in g Sy st em . CANCELE D Volume 1 - Integrated Safety Management System Guide - Page 57 Chapter III 5-27-99 DOE G 450.4-1A 2.2.2 Gap Analysis As the complete set of programs is identified, it is necessary to objectively analyze the programs to determine which of the seven guiding principles and five core functions are addressed by the various procedures and manuals of practice. Accordingly, ISMS developers use the “gap analysis” to ensure integration and to identify missing or weak elements. A gap analysis can be completed in conjunction with the review of the existing system, using the matrix in Figure 6. In each cell of the matrix, the contractor should enter the procedures from the existing manuals of practice and address the core functions and guiding principles. When there is no cell entry or the procedure entered is judged deficient, a gap in the ISMS for the facility, activity, or site being analyzed is identified. For some types of facilities, one or more missing elements may be appropriate. However, if the missing or weak element is deemed to be important, corrective action should be taken to provide revised documentation that will permit implementation of the necessary ISMS element.

3. IMPLEMENTATION 3.1 DOE Actions Required to Support Implementation of ISMS This section highlights several DOE functions in the FRAM that DOE must perform to support implementation of an ISMS. Note that the ISMS expectations in Section 4 include expectations for the DOE field office. Expectations related to DOE are narrowly focused on those functions, responsibilities, and authorities that clearly interface with the contractor’s ISMS. It should be clear from the outset that the DOE field office and the contractor must work as a team to ensure effective integration of all safety management functions. The sections below identify the important DOE functions in the FRAM that relate to implementation of an ISMS. The contractor and the DOE field elements should both become familiar with these because the contractor’s ISMS must support DOE in its performance of these functions. These DOE functions flow from the Orders. Further guidance is provided in the FRAM and FRAs. 3.1.1 Core Function 2, Analyze Hazards a. Identify Hazards (FRAM 9.3.1). Section 9.3.1 requires the FEM to ensure the contractor’s analysis covers the hazards associated with the work and is sufficient for selecting safety standards. Section 9.3.1 requires EH to monitor and provide technical support on hazard identification and analysis activities as requested or directed by the CSO to ensure the CANCELE D Page 58 - Integrated Safety Management System Guide - Volume 1 5-27-99 Chapter III DOE G 450.4-1A standards are sufficient to facilitate selection of the appropriate safety standards. EH is also required to provide guidance for and interpretation of requirements for all DOE elements on hazard analyses. b. Analyze Hazards (FRAM 9.3.1). See “a” above. c. Categorize Hazards (FRAM 9.3.2). Section 9.3.2 requires CSO approval of the final facility categorization (if this authority has not been delegated). This section also requires the FEM to concur in the facility/activity classification level based on input from contractors regarding the type and amounts of hazards. 3.1.2 Core Function 3, Develop/Implement Hazard Controls a. Identify Standards and Requirements (FRAM 9.4.1). For Hazard Category 1 nuclear facilities, FRAM 9.4.1 requires the FEM to direct the contractor to propose site- or facility-specific standards tailored to the work and hazards. The CSO must approve the specific requirements to be included in the contract, the safety documentation, and the authorization basis. The FEM must ensure that appropriate safety requirements in necessary functional areas are included in the contracts. The CO must incorporate approved standards into contract requirements. Similar requirements are given in Section 9.4.1.2 for Hazard Category 2 and below nuclear facilities and non-nuclear facilities. However, for these facilities, the CSO may retain or delegate approval authority. Sections 9.4.1.3, 9.4.1.4, and 9.4.1.5 provide guidance on options for exemptions. b. Identify Controls to Prevent/Mitigate Hazards (FRAM 9.4.2). For Hazard Category 1 nuclear facilities, Section 9.4.2.1 requires the FEM to direct the contractor to document controls for prevention and mitigation of hazards and to review the adequacy of the controls and their documentation. The FEM must also provide line management oversight and ensure the implementation of hazard mitigation programs and controls. The CSO must ensure the adequacy of these controls and the adequacy of funding for their implementation.

Section 9.4.2.2 provides similar requirements for Hazard Category 2 and 3 nuclear and non-nuclear facilities. However, the CSO provides line management oversight of the FEM program for these facilities. c. Establish Safety Controls (FRAM 9.4.3). For Hazard Category 1 nuclear facilities, Section 9.4.3.1 requires the CSO to approve the authorization basis associated with the safety documentation. The CSO may delegate this authority to a Headquarters program line manager or to the FEM. The FEM must direct preparation of the authorization basis and associated safety documentation and oversee implementation CANCELE D Volume 1 - Integrated Safety Management System Guide - Page 59 Chapter III 5-27-99 DOE G 450.4-1A by the contractor. EH shall review and comment on the authorization basis and associated safety documentation for Hazard Category 1 nuclear facilities where requested or directed. Section 9.4.3.2 contains similar requirements for Hazard Category 2 and below nuclear and high and moderate hazard accelerators. The CSO may also delegate this authority to the FEM. Section 9.4.3.3 describes responsibilities for authorization protocols. This section requires the CSO to ensure systems are in place for the development and implementation of appropriate authorization protocols, including a protocol for assessment support to the FEM. The HCA is required to determine the appropriate protocol based on the work and hazard, to approve the authorization agreement, and to append it to or modify the affected contract. d. Implement Controls (FRAM 9.4.4). Section 9.4.4 requires the FEM to monitor the proper implementation of controls, including contractor processes for USQs and configuration management. 3.1.3 Core Function 4, Perform Work a. Confirm Readiness (FRAM 9.5.1). Section 9.5.1.1 requires the FEM to ensure that the ORR is conducted by an ORR team in accordance with DOE O 425.1, STARTUP AND RESTART OF NUCLEAR FACILITIES. Section 9.5.1.3 requires the FEM to determine the appropriate level of readiness necessary for the startup of non-nuclear facilities. The FEM and EH must shut down work if a clear and present safety danger exists. The FEM must promptly notify the CSO and EH. b. Perform Work Safely (FRAM 9.5.2). Section 9.5.2 requires the CSO and the FEM to ensure that the ISMS is properly implemented. The FEM must also ensure contracts are properly implemented and must perform line management oversight of the contractor’s worker, public, environment, and facility protection programs. The FEM must also maintain day-to-day operational oversight of contractor activities at applicable facilities through DOE Facility Representatives. Section 9.5.3 requires the Secretarial Officer (SO) and the FEM to ensure implementation of QA programs and to ensure that contractors implement quality assurance programs. 3.1.4 Core Function 5, Feedback and Improvement a. Collect Feedback Information (FRAM 9.6.1.1 and 9.6.1.2). Section 9.6.1.1 requires the CSO to implement a lessons-learned program and remain cognizant of information likely to be useful in improving the performance of the programs under CANCELE D Page 60 - Integrated Safety Management System Guide - Volume 1 5-27-99 Chapter III DOE G 450.4-1A that office’s direction. The CSO must also collect information for use in this program from assessments of contractor and field element operations. Section 9.6.1.1 requires the FEM to direct the contractors to develop a lessons- learned program and to monitor its implementation.

Section 9.6.1.2 requires the FEM to direct the contractor to report occurrences on the Occurrence Reporting and Processing System (ORPS). The program manager is responsible for approving ORPS reports. The FEM must review the reports and approve proposed corrective actions, where authority is delegated, or recommend approval decision to the CSO. EH is required to develop, maintain, and implement the ORPS and to prepare and disseminate information obtained from analysis of this information. EH must also develop requirements and guidance for occurrence reporting, seek feedback for continuous improvement of ORPS, and upgrade the requirements as appropriate. b. Identify Improvement Opportunities (FRAM 9.6.1.3). Section 9.6.1.3 requires EH to perform oversight of ES&H performance, to identify needed improvements, and to communicate that information to CSOs, FEMs, and contractors as appropriate. c. Make Changes to Improve (FRAM 9.6.2). Section 9.6.2 requires all DOE elements to continuously improve the efficiency and quality of operations and to develop, implement, and track corrective actions in order to profit from prior experience and the lessons learned. 3.2 Contractor Actions to Implement ISMS As mentioned in Section 1 of this chapter, the contractor is required to provide a documented ISMS. The documentation includes an ISMS description that explains how the existing documented procedures and manuals of practice satisfy ISMS. Appendix F provides material extracted from some of the existing ISMS description documents that illustrates approaches to providing the descriptions. 3.2.1 Preparing ISMS Documentation The DEAR requires that the ISMS be documented. To a large extent, the required documentation may consist of the contractor’s corporate procedures and manuals of practice used to perform work. In addition, a data base may also be compiled based on information from the existing procedures and manuals of practice and a gap analysis of the type identified in Section 2 of this chapter. The ISMS description can serve as a “road map” explaining the relationship of these documents to the activities being performed, assuming these documents exist and are complete in their coverage of the DOE requirements. If this is not the case, deficiencies in the documentation should be identified CANCELE D Volume 1 - Integrated Safety Management System Guide - Page 61 Chapter III 5-27-99 DOE G 450.4-1A and scheduled for correction prior to completion of the review and approval of the system. Generally, the ISMS description identifies existing policies, procedures, manuals of practice, and other contractor ISMS mechanisms. Additionally, many contractors have found it beneficial to provide details on the overall ISMS philosophy or vision, the implementation mechanisms, and the integrating mechanisms. Most contractors have organized their ISMS descriptions to reflect the core functions and guiding principles (see Appendix F and the DEAR). a. Identifying and Describing Procedures and Manuals of Practice. As part of the ISMS implementation process, the contractor should review and evaluate existing policy manuals, procedure manuals, and workplace instructions. Some of these will be sitewide documents while others will be specific to a facility or work activity, including activities performed by subcontractors. The documentation of interest includes business procedures and practices that allocate resources and prioritize work, as well as work instructions intended to protect the public, worker, and environment. This set of documentation currently exists at most sites and facilities, but may not be readily identified with the DOE functions and principles required in an ISMS. Contractors may find it appropriate to evaluate how these manuals form an integrated system.

b. Describing Integrating Mechanisms. Documented procedures and practices do not inherently produce the integration that is expected by DOE Policies and the DEAR clauses. This is particularly true for sites that have many diverse facilities performing work for several DOE program offices. It is also true that sitewide programs usually exist to address safety, environmental, and waste minimization activities that need to be integrated with specific programmatic work. A number of mechanisms may be incorporated into the ISMS to encourage integration. Specific business and work procedures may be used to support the integration. Some organizations use regularly scheduled subject area meetings (e.g., engineering councils) at various levels of the organization to encourage integration and information exchange. Such councils can be part of the documented business practices in the ISMS. Other integration mechanisms may include sitewide maintenance manuals, sitewide safety meetings, and safety boards. Reviews and assessments, both programmatic and sitewide, and feedback of lessons learned to all programs are mechanisms that also contribute to integration. Although DOE-STD- 1120 is specifically written for disposition activities, it provides guidance and examples for integrating planning, hazards analysis, and controls, and the methodology is generally applicable to other parts of the facility life cycle. Typical sitewide programs that should be integrated into work activities include engineering support, fire protection, emergency preparedness, maintenance, CANCELE D Page 62 - Integrated Safety Management System Guide - Volume 1 5-27-99 Chapter III DOE G 450.4-1A environmental protection, waste management, industrial hygiene, occupational safety, chemical safety, radiological protection, training, and conduct of operations (including procedures). An ISMS description should identify the integration of environment, safety, and health into the contractor’s business processes for work planning, budgeting, authorization, execution, and change control. This requires integration within the line organizations and integration with the organizations supporting the line. The ISMS description should address the flow-down of safety management to subcontractors. The development of procedures and practices for prioritization of both programmatic and sitewide work activities important to safety is an important integration activity that should be documented and integrated with interfacing DOE procedures and practices. 3.2.2 Additional Considerations Contractors that have successfully implemented an ISMS have appointed a group, team, or board with responsibility for oversight, maintenance, and implementation of the ISMS. Implementation is much more than producing good ISMS documentation and disseminating it. As discussed in Chapter III, Section 2.2, the first step is generally to identify weaknesses in the existing system and fix them through additional policies, procedures, mechanisms, and/or training. A well-functioning team conducts periodic meetings with the affected organizations to monitor progress, communicate changes to ISMS procedures, and promote improvement of the ISMS. The need for a process to evaluate ISMS effectiveness is included in the DEAR.

Contractors with complex nuclear facilities have also found it necessary to form or reform integrating mechanisms to meet the intent of the ISMS Policy. Specifically, they have generally constituted boards or panels that report to line management and have the responsibility for and authority to obtain functional area support to provide advice, expertise, and/or approval as appropriate on ES&H integration issues. Some contractors have found it useful to “pilot” any new integrating mechanisms (e.g., safety boards) at one facility to work the bugs out before implementing it sitewide. 3.2.3 ISMS Attributes The attributes listed below summarize DOE expectations for the overall performance and documentation of the contractor’s ISMS. • The ISMS is consistent with the DOE Policies, DEAR Requirements for Integrated Safety Management, and HCA direction to the contractor. CANCELE D Volume 1 - Integrated Safety Management System Guide - Page 63 Chapter III 5-27-99 DOE G 450.4-1A • The ISMS description indicates how the contractor will evaluate and improve the effectiveness of the ISMS. • The ISMS description indicates how performance objectives and performance measures are established in response to DOE program and budget guidance. • The contractor directs, monitors, and verifies implementation of the ISMS as described in the system description. • Implementation and integration expectations and mechanisms are evident throughout all organizational functions and across all organizations from the site to the individual activities. • The contractor has assigned responsibilities and established the mechanisms to ensure that the ISMS is maintained and that the annual update information is prepared and submitted. 4. EXPECTATIONS AND ATTRIBUTES OF ISMS DOCUMENTATION This section describes the expectations and attributes of a contractor’s ISMS for the benefit of those who must prepare the ISMS documentation and for reviewers who must evaluate adequacy of the ISMS. The list of expectations provide summary descriptions of ISMS performance with respect to the ISMS core functions and principles. The attributes identify specific criteria that can be used to guide development and evaluation of an ISMS. Responsibilities for the review and approval of ISMS are specified in DOE M 411.1-1, which makes the HCA responsible for approving the ISMS description and revisions. HCA responsibilities are normally assigned to the manager of the cognizant DOE operations office, who is generally known as the approval authority. To carry out these responsibilities, the approval authority must decide whether team review is needed, and, if it is, to select members of the review team. If a review team is needed, the approval authority selects the team leader from a list approved by the Deputy Secretary. The team leader and the assembled team should use the guidance provided in Volume 2, Appendix E, of this Guide and the Draft Integrated Safety Management System Verification Process, Team Leader’s Handbook, Project Number SAFT- 0065, to plan for and conduct the ISMS review. The team reports the results of the review to the approval authority along with a recommendation concerning approval of the ISMS. DOE and its contractors should ensure that the ISMS that has been developed is consistent with the objectives, guiding principles, and core functions required by the DEAR. The expectations and attributes described below serve as a guide for addressing the five core functions and the seven guiding principles in the contractor’s ISMS documentation. The acceptability of the level of detail for each item should be based on the work and its associated hazards to ensure adequate

CANCELE D Page 64 - Integrated Safety Management System Guide - Volume 1 5-27-99 Chapter III DOE G 450.4-1A protection for workers, the public, and the environment. Note that ISMS expectations and attributes include subjects to be addressed by the DOE field office. This is appropriate because both the SMS Policy (DOE P 450.4) and the FRAM lay out expectations for DOE with respect to the contractor’s ISMS. 4.1 Expectations for Core Function 1, Define Scope of Work, and Guiding Principle 4, Balanced Priorities DOE establishes a set of processes to ensure that the scope of work is adequately reviewed and that interactions with the contractor proceed efficiently and effectively. 4.1.1 Translate Mission into Work An ISMS should include a process to identify the activities necessary to accomplish the assigned mission and a process to develop these activities into discrete tasks. DOE uses strategic plans, goals, objectives, and mission statements to define the contractor’s broad work assignments; the contractor in turn uses these assignments to prepare its work proposals (see Chapter II, Section 2.1). Attributes • Expectations received from DOE as part of the field budget call are translated into tasks that permit identification of resource requirements, priorities, and performance metrics. • DOE has incorporated DEAR 970.5204-2, Integration of Environment, Safety and Health into Work Planning and Execution, into the contract. • The DEAR requirements are communicated to management and workers. • The DEAR requirements are applied to subcontracts involving complex or hazardous work. 4.1.2 Set Expectations An ISMS should include processes for establishing performance objectives that address safety objectives and the work assignments for the site. Such processes should include DOE budget execution guidance and employee performance reviews and appraisals. As directed in the DEAR ES&H clause, performance objectives and performance measures are to be a result of the DOE budget guidance and are linked to mission accomplishment as defined in strategic plans of DOE, the line programs (e.g., ER, EM, DP), and site- specific mission objectives. Additionally, those safety objectives and measures developed CANCELE D Volume 1 - Integrated Safety Management System Guide - Page 65 Chapter III 5-27-99 DOE G 450.4-1A should demonstrate connection to the safety functions and principles identified in the DEAR clause and reinforced in DOE P 450.4 (see Chapter II, Section 2.3). Attributes • DOE budget and work expectations and priorities are authorized and communicated to the contractor [e.g., via a work authorization statement (WAS) or other authorization document]. • Expectations for tasks flow from DOE to the Management and Operating (M&O) or Management and Integrating (M&I) contractors, to the subcontractors, to the individual facility, process, or work task as appropriate. 4.1.3 Provide for Integration The DEAR ES&H clause [48 CFR 970.5204-2(b)(6)] and DOE P 450.4 require the integration of environment, safety, and health functions and activities including pollution prevention and waste minimization into work planning and execution. Integration should be evident throughout all organizational functions at all organizational levels from the site to the individual activity. Chapter I, Section 1, discusses in detail important considerations for proper integration. Typical sitewide processes, procedures, and/or programs that need to be integrated include engineering support, fire protection, emergency preparedness, maintenance, environmental protection, waste management, industrial hygiene, occupational safety, chemical safety, radiological protection, and training.

Attributes • Environment, safety, and health management processes and procedures and/or programs that apply to site, facility, and work activities are integrated (see Section 4.4 below). • The ISMS is applied to all types of work and addresses all types of hazards. • ES&H requirements flow down to each person (employees, subcontractors, temporary employees, visiting researchers, vendor representatives, etc.) performing work. • Line management is responsible for compliance with ISMS requirements regardless of who is performing the work (see Chapter II, Section 2.4). CANCELE D Page 66 - Integrated Safety Management System Guide - Volume 1 5-27-99 Chapter III DOE G 450.4-1A 4.1.4 Prioritize Tasks and Allocate Resources An ISMS should include processes for prioritizing and allocating work. To establish balanced priorities, a formal method should be employed (see Chapter II, Section 2.5). The necessary criteria for a quality risk-based prioritization method are described in DOE- DP-STD-3023-98, Guidelines for Risk-Based Prioritization of DOE Activities. Protecting the public, the workers, and the environment is always a priority in the planning and performance of work activities. Balancing priorities is particularly important when defining work, assessing hazards, identifying controls, and designing feedback and continuous improvement programs. Once a decision is made to accomplish a particular task, all the controls identified for that task are also necessary; as a result, the decision to do the work includes a prioritization decision to apply the necessary resources as defined by the agreed-upon controls (see Chapter II, Section 2.5). Note that each of the processes described above would generally be part of the contractor’s project management system, which would be used in defining operations plans, work plans, and budgets (see Chapter II, Sections 2.1 and 2.5). Attributes • DOE approves the contractor’s proposed tasks and prioritization of the mission expectations transmitted to the contractor. • The approved task identification, prioritization, and funding are subject to configuration management processes to ensure formal change control. • Task prioritization and funding allocation clearly address both ES&H and programmatic needs. • Line management provides input and approval of task prioritization and funding allocation. • Task prioritization and funding allocation clearly address commitments to and agreements with DOE and stakeholders. • Funding allocation provides resources to adequately analyze hazards associated with the work. • Funding allocation provides resources for implementation of hazard controls for tasks being funded. CANCELE D Volume 1 - Integrated Safety Management System Guide - Page 67 Chapter III 5-27-99 DOE G 450.4-1A 4.2 Expectations for Core Function 2, Analyze Hazards Hazard analyses are performed at each organizational level—from the work defined in the sitewide mission statement (as in an EIS), to the processes at an individual facility (SARs, HASPs, pollution prevention, etc.), to the individual operational or maintenance item contemplated within a facility (as in a job hazard analysis). The objective of hazards analysis is to develop an understanding of the potential for a hazard to affect the worker, the public, and the environment and to develop a seamless hazard analysis covering the site, facility, and work task being performed. The selection of controls is then developed, in part, based on the hazard analysis.

In addition to the hazard identification and analysis performed to support line management, safety-related training and heightened safety awareness through structured worker programs should enable each worker to identify hazards in the workplace. It is important that workers know where to go and what to do should a new hazard be identified. Environmental, safety, and health professionals and line supervisors must be visible and available to assist workers in better understanding hazards in the workplace. Administrative controls should be established through the application of safe work standards and/or agreed-upon requirements to keep the workplaces safe. Again, workers must question their understanding of what the hazard controls are in each work area so that they fully understand the measures taken for their protection. Each level of hazard analysis is the foundation for more detailed analysis; that is, a site-level hazard analysis is used as the basis for the facility-level analysis, which in turn is used as the basis for the activity- or task-level analysis. Hazard identification and analysis may occur at any point in a project life cycle: as part of design, operations, maintenance, deactivation or decommissioning. 4.2.1 Identify Hazards An ISMS includes processes for identifying hazards (e.g., nuclear, industrial, fire, external events, construction, environmental impact, etc.). Attributes • All types of hazards (e.g., nuclear, chemical, industrial, fire, external events, construction, environmental impact, etc.) are addressed. • The identification process is tailored to the type of hazard (e.g., walk-throughs for industrial hazards), the type of work (e.g., design, construction, operation, maintenance, deactivation and decommissioning, etc.), and the magnitude of the hazard’s risk. CANCELE D Page 68 - Integrated Safety Management System Guide - Volume 1 5-27-99 Chapter III DOE G 450.4-1A 4.2.2 Analyze Hazards An ISMS includes processes for analyzing hazards. Attributes • DOE and other regulatory requirements (e.g., those addressed by DOE 5480.23, DOE 5480.25, 29 CFR 1910, 40 CFR, etc.) are implemented as appropriate to the work, the type of hazard identified, and the magnitude of its risk. • Hazard analysis methods address all types of hazards (e.g., nuclear, industrial fire, external events, natural phenomena, construction, chemical, etc.). • Hazard analysis methods are applied to all types and stages of work (e.g., design, construction, normal operations, surveillance, deactivation, maintenance, facility modification, decontamination and decommissioning, etc.) 4.2.3 Categorize Hazards An ISMS should include a process for categorizing hazards, such as that defined in DOE- STD-1027 for nuclear facility operations. DOE O 430.1, LIFE-CYCLE ASSET MANAGEMENT, its associated guides, and DOE-STD-1120 provide special hazard identification and analysis methods that apply to facility disposition activities. Attributes • The hazard analysis method, level of detail, and resultant controls are appropriate to the hazard category (see Chapter II, Section 3). • Hazard categorization is consistent with DOE-STD-1027 and DOE O 430.1A. 4.3 Expectations for Core Function 3, Develop/Implement Hazard Controls; Guiding Principle 5, Identification of Safety Standards and Requirements; and Guiding Principle 6, Hazard Controls Tailored to Work Being Performed

Before work is performed, the associated hazards are evaluated and DOE and the contractor agree upon a set of ES&H requirements that, if properly implemented, will provide adequate assurance that the public, the workers, and the environment are protected. Figure 4 (Chapter II) illustrates the conceptual process for establishing sitewide ES&H requirements and applying those requirements to individual tasks. 4.3.1 Identify Standards and Requirements CANCELE D Volume 1 - Integrated Safety Management System Guide - Page 69 Chapter III 5-27-99 DOE G 450.4-1A (Core Function 3 and Guiding Principle 5) An ISMS should include processes to establish the set of ES&H requirements for the work consistent with the requirements of the DEAR (see Attachment 4). The process for identifying ES&H requirements should be one of the existing, accepted approaches, or it should be consistent with the objectives and concepts of these existing, accepted approaches (Chapter II, Section 4.1). If a method/approach other than an existing, accepted one is proposed, the contractor should provide a description for DOE review and approval. The use of applicable laws, statutes, Federal rules, national consensus standards, DOE directives, and DOE Technical Standards is described in Chapter II, Section 4.1. Attributes • The contractor identifies, selects, and approves ES&H standards and requirements with a process that provides adequate protection to the public, the workers, and the environment. • The identified ES&H standards and requirements are agreed upon and approved prior to the commencement of the operations or work being authorized. • The identified ES&H standards conform to applicable laws, statutes, Federal rules, and DOE directives. • DOE reviews, verifies, and approves the contractor’s ES&H standards and requirements, as defined in S/RIDs, Work Smart Standards (WSSs), or other DOE- approved processes. 4.3.2 Identify Controls to Prevent/Mitigate Hazards An ISMS should include a process for identifying and tailoring administrative controls, safety controls, safety programs, and other conditions that affect the work to be performed (Guiding Principle 6). The processes should use information obtained in the hazard analysis and define the requirements for each phase or discrete task of the planned work (see Chapter II, Section 4.3). As with the hazard analysis, controls developed at the site level should be used as the basis for facility controls and those in turn used to develop controls at the work/task level. DOE-STD-1120 describes the process of developing detailed, task-level controls from the generic, site-level controls. Attributes • Controls are tailored to the hazards associated with the work or operations to be authorized. • Hazard prevention programs appropriate to the facility’s life cycle are implemented. CANCELE D Page 70 - Integrated Safety Management System Guide - Volume 1 5-27-99 Chapter III DOE G 450.4-1A • Controls are addressed for all activities (e.g., construction, normal operations, surveillance, maintenance work, facility modifications, etc.). • Controls are addressed for all aspects of the work (e.g., initiation, review, authorization, and execution). • All types of controls (e.g., radiation protection, pollution prevention, RCRA, CERCLA, etc.) are addressed. • A process or mechanism should be provided that recognizes the control hierarchy (Section 4) and integrates those controls.

• Identified controls are agreed upon and approved prior to the commencement of the operations or work being authorized. • Hazard controls are reviewed and approved by DOE as appropriate to the work. 4.3.3 Establish Safety Controls An ISMS should include a process to establish and document engineered controls, administrative controls, safety controls, safety programs, and other conditions that affect the work to be performed. An ISMS should include processes for establishing and maintaining the safety boundaries (safety envelope) for the work. Some contractors achieve this objective through the use of work packages, job plans, maintenance plans, and formally established safety requirements, such as Operational Safety Requirements (OSRs) or TSRs. The latter requirements are used in DOE nuclear facilities (see Chapter II, Section 4.3). Attributes • Safety boundaries for the work are established and maintained. • Appropriate controls, conditions, and requirements (e.g., TSRs, OSRs, OSHA and EPA regulations) that constitute the safety boundaries are identified (see Chapter II, Section 4.3 for additional details). • Contractor and DOE procedures define the processes for development, approval, and maintenance of work authorization documentation including authorization agreements. • Safety controls are established using the control hierarchy (Section 4). 4.3.4 Implement Controls CANCELE D Volume 1 - Integrated Safety Management System Guide - Page 71 Chapter III 5-27-99 DOE G 450.4-1A An ISMS should provide a method to implement the controls identified at every level of work and hazard. The methods should provide assurance that the controls remain in effect so long as the hazard is present. A method should be briefly described for translating/transmitting formal control documentation to the working level (“floor level”) procedures used by workers (see Chapter II, Section 4.3). Attributes • Engineered controls, administrative controls, safety controls, safety programs, and other conditions that affect the work to be performed are implemented. • Personnel are qualified (e.g., a personnel training and qualification program) to discharge their responsibilities satisfactorily (Guiding Principle 3) (see Chapter II, Section 1). • Controls for all authorized work are developed, approved, and implemented. 4.4 Expectations for Core Function 4, Perform Work, and Guiding Principle 7, Operations Authorization 4.4.1 Confirm Readiness An ISMS should include a process to confirm that the facility or process and the operational work force are in an adequate state of readiness prior to authorizing the performance of the work [e.g., Guiding Principle 7, readiness assessments, ORRs, Title III inspections (project design), etc.] (see Chapter II, Section 5). Attributes • Controls are adequate to mitigate the identified hazards and the controls are implemented prior to commencement of work. • Personnel are qualified and trained for performance of work in accordance with the controls established (Guiding Principle 3) (Chapter II, Section 1). • Controls are adequate to ensure safe work performance and to prevent accidents, uncontrolled releases, or unacceptable exposures to hazardous materials (Chapter II, Section 5). • The necessary safety support functions and interfaces (e.g., training, maintenance, radiological protection, etc.) are established (Chapter II, Section 5). CANCELE D Page 72 - Integrated Safety Management System Guide - Volume 1 5-27-99 Chapter III

DOE G 450.4-1A • The operability of the necessary facility or process systems required for safe operation are verified in accordance with the bases established in appropriate authorization agreements. 4.4.2 Operations Authorization An ISMS should include a method for gaining authorization to conduct operations. Provisions should be included to grant operations authorizations for each level of effort at the site, facility, activity, or process. Such provisions or procedures may include an ORR, approval to resume operations following a weekend shutdown, and authorization to start individual procedures or work items using controls such as work clearance permits, shift orders, or shift manager’s control. An ISMS should also include a method for updating and configuration control of the operations authorization documentation, such as authorization agreements, permits, SARs, etc. (see Chapter II, Section 5). Attributes • Conduct of operations at the individual facility or process level is authorized by a process appropriate to the work. • DOE verifies and authorizes work as appropriate before work commences. 4.4.3 Perform Work Safely An ISMS should include processes for ensuring that safety requirements are integrated into work performance (e.g., via work practices and floor level procedures, described in Section 4.3.4 above). Processes should be adequate to ensure that work is performed within the controls that have been developed and implemented. Controls may include site or facility commitments, such as conduct of operations and maintenance programs; worker safety programs; specified safety systems; or specific controls in work permits. The controls may be specified in site-level programs or facility-specific authorization bases documents. An ISMS should include provisions to ensure that ongoing work continues to be performed within the specified and agreed-upon controls. Attributes • Controls remain in effect so long as the hazard is present. • Personnel are responsible and accountable for performance of work in accordance with the controls established (Chapter II, Section 1). • The controls established for safety are a discernible part of the work plan. CANCELE D Volume 1 - Integrated Safety Management System Guide - Page 73 Chapter III 5-27-99 DOE G 450.4-1A • DOE ensures that work is performed within controls. 4.4.4 Performance Measures An ISMS should include a process to identify performance measures and indicators, including safety performance measures for the work (see Section 4.1.2 above and Chapter II, Sections 5 and 6). Attributes • Performance measures and indicators provide information that is truly a direct indicator of how safely the work is being performed. • Performance measures and indicators are clearly linked to performance objectives and expectations. • Performance measures and indicators are performance based. • Performance measures and indicators are used by line managers as part of the self- assessment process (see Chapter III, Section 5.2, and Appendix D of Volume 2). 4.5 Expectations for Core Function 5, Feedback and Improvement

All aspects of an ISMS should be subject to continuous improvement through an assessment and feedback process, which should function at each level of work and at every stage in the work process. To determine adequacy and/or performance in execution of the ISMS, DOE and the contractor should establish and agree upon a set of objectives and criteria. When used in determining whether implementation of the ISMS is adequate, these agreed-to objectives and criteria may support a determination of contractor fees. These objectives and criteria may also be useful in identifying those day-to-day performance indicators that can assist in continually evaluating the effectiveness of the ISMS. The feedback/improvement process includes the following: • Feedback information on the effectiveness of the ISMS and the adequacy of controls is gathered. • Opportunities for improving work execution and planning are identified and implemented. • Line and independent oversight is conducted. • If necessary, regulatory enforcement actions occur. CANCELE D Page 74 - Integrated Safety Management System Guide - Volume 1 5-27-99 Chapter III DOE G 450.4-1A 4.5.1 Collect Feedback Information An ISMS should include processes for operational safety, such as self assessment, monitoring against performance objectives, occurrence reporting, and routine observation. The processes should include line management and worker feedback as well as independent oversight (see Chapter II, Section 6, and Appendix D). All employees must be empowered to have a strong, questioning attitude and to provide feedback to managers and supervisors. This empowerment encourages new avenues for continuous improvement in the workplace. Employees should be provided with appropriate safety incentives to identify improvement opportunities, conduct line and independent oversight, and to take the steps necessary to effect changes to maintain and improve their workplace safety. Attributes • Line and independent oversight or assessment is conducted at all levels by DOE and the contractor. • Oversight and assessment activities verify that work is performed within agreed-upon controls. 4.5.2 Identify Improvement Opportunities An ISMS should evaluate feedback and oversight information. Such an evaluation should include processes for translating this operational information into recommendations for improvement and processes for translating lessons learned both onsite and from other sites into recommendations for improvement. An ISMS description should include a worker suggestion program for improving safety. Attributes • Performance measures or indicators and performance objectives are developed in coordination with DOE. Further, contractor management and DOE use performance measures and objectives effectively (see Section 4.4.4 above). • Feedback (including worker input) and lessons learned are managed to improve safety and work performance. 4.5.3 Make Changes to Improve An ISMS should contain processes for management to consider and dispose of recommendations for improvement, including worker suggestions. The description should CANCELE D Volume 1 - Integrated Safety Management System Guide - Page 75 Chapter III 5-27-99 DOE G 450.4-1A illustrate the process for translating feedback from assessments, lessons learned programs, external oversight and enforcement, and other inputs into improvements. Attributes • Oversight or assessment results are managed to ensure lessons are learned and applied throughout the site.

• Issues are identified (including worker input) and managed to resolution. • Fundamental causes are determined and effective corrective action plans are developed and implemented. 4.5.4 Oversight and Enforcement An ISMS should include processes for oversight by contractor management. Interfaces for communication with external oversight organizations should be indicated (e.g., EPA, OSHA, DOE Office of Oversight, etc.). Attribute • Regulatory compliance and enforcement as required by rules, laws, and permits such as PAAA, NEPA, RCRA, CERCLA, FFCA, etc., are ensured. 4.6 Expectations for Guiding Principle 1, Line Management Responsibility for Safety, and Guiding Principle 2, Clear Roles and Responsibilities At every level of control, line management must be responsible for safety; therefore, clear and unambiguous roles and responsibilities should be defined and maintained at all levels within the organization defined by the ISMS description. All aspects of work identification, planning, and execution should be under the control and responsibility of line management. Support organizations, such as ES&H or human resources, must have clearly defined roles and responsibilities that ensure work is performed safely within the principle that line management is responsible for safety (see Chapter II, Section 1). Attributes • All personnel have clear roles and responsibilities to ensure that safety is maintained at all levels. • Line management is responsible for safety. • Line management is responsible for ensuring the implementation of hazard controls. CANCELE D Page 76 - Integrated Safety Management System Guide - Volume 1 5-27-99 Chapter III DOE G 450.4-1A • Facility and process planning is adequate to ensure that work is planned, approved, and conducted safely. • Adequate implementation of controls is verified prior to authorization to commence work. • Line management is responsible for ensuring that controls to ensure work is accomplished safely are verified and maintained as required by the approved safety authorization basis. • DOE personnel assigned to oversee, review, and approve the development of safety basis/authorization basis documentation have clearly defined roles and responsibilities. • DOE FRA documents or other ISMS procedures specify clear roles and responsibilities for DOE line management. • DOE FRA documents or other ISMS procedures specify that DOE line management is responsible for safety. 4.7 Expectations for Guiding Principle 3, Competence Commensurate with Responsibility All organizations and activities within the ISMS should be evaluated to ensure that personnel have the experience, knowledge, skills, and abilities necessary to discharge their assigned responsibilities. Accordingly, the ISMS description should establish core competencies for support and line personnel—workers as well as managers. In addition, the ISMS description should provide for programs to define personnel performance expectations, provide training, and evaluate performance to determine whether expectations are met (see Chapter II, Section 1). Attributes • Contractor personnel, including line management, have competence commensurate with their assigned responsibilities. • DOE FRA documents or other ISMS procedures ensure that personnel, including line management, have competence commensurate with their assigned responsibilities. • Personnel who plan, supervise, or actually perform work within controls have competence commensurate with their responsibilities.

• DOE personnel assigned to review and approve safety basis/authorization basis documentation, including the implementation of safety controls, have competence commensurate with responsibilities. CANCELE D Volume 1 - Integrated Safety Management System Guide - Page 77 Chapter III 5-27-99 DOE G 450.4-1A 5. OVERSIGHT ISMS-related assessments need to be conducted to verify that safety obligations are being met. The use of safety management assessments for this purpose is discussed in Appendix D. DOE P 450.5 (Attachment 2) provides the fundamental framework for the Department’s expectations for DOE line management ES&H oversight. The Policy notes that the use of contractor self- assessment programs is the cornerstone for this oversight. However, as noted in Section 4.5, there are additional regulatory and DOE independent oversight activities that contribute feedback on the adequacy of the ISMS. The initial ISMS review and approval required in the FRAM is the first in a continuing series of independent DOE oversight activities. 5.1 Oversight and Enforcement (FRAM 9.6.3) The FRAM establishes the following requirements for DOE’s oversight and enforcement role. Like other parts of the ISMS it depends on the contractor providing an organization and documentation that supports DOE completing its required functions. Section 9.6.3.1 requires the FEM to ensure that duly authorized independent oversight personnel have unfettered access to information and facilities, consistent with safety and security requirements. Section 9.6.3.1 requires EH-2 to– • perform independent oversight of line management to assess success of the DOE ISMS and supporting programs for doing work safely and • report the results of independent oversight activities to the Secretary, Congress, CSOs, FEMs, and the contractors. Section 9.6.3.2 requires the FEM to perform management assessments of contractors to evaluate their success in doing work safely, to review their performance against formally established ES&H performance indicators, and to take appropriate action. Section 9.6.3.3 requires the FEM to monitor contractor actions to report nuclear safety violations to the Office of Enforcement (EH-10) for review under the provisions of 10 CFR 820. The FEM and the CSO must refer violations to EH-10 for review under the provisions of 10 CFR 820 where appropriate. Section 9.6.3.3 requires EH-10 to investigate noncompliances with nuclear safety rules, to assess the level of violation of noncompliances, and to issue notices of violations where appropriate. EH-10 is also required to establish, maintain, and implement a noncompliance tracking system for self-reporting by contractors. EH-10 must also issue civil penalties where appropriate and refer violations to the Justice Department for criminal review where appropriate. The Secretary shall receive appeals and grant or deny them. CANCELE D Page 78 - Integrated Safety Management System Guide - Volume 1 5-27-99 Chapter III DOE G 450.4-1A 5.2 Contractor Implementation DOE P 450.5 describes a transition process for DOE field element oversight as effective contractor self-assessment programs are established. The DOE field, in this case, focuses more on maintaining operational awareness of contractor work activities and reviews performance against formally established ES&H performance indicators, using contractor self assessments. The contractor organization and documentation should be structured to support these DOE functions.

In its requirements for describing the ISMS, the DEAR references performance objectives and performance measures. The DEAR also tasks contractors to describe how they will measure the effectiveness of the ISMS and ensure a process of continuous improvement. Performance objectives and performance measures have generally been linked to the contract, budget, and DOE program execution guidance. Most contractors have found it necessary, in addition to establishing performance objectives and performance measures, to establish key performance indicators to enable them to assess the effectiveness of their ISMSs. These indicators should result in a set of metrics which, if properly identified and used, would demonstrate the status of the safety management programs and the overall effectiveness of the ISMS. Circumstances at each site will cause some of the metrics to be unique although others will be the same as at other sites. Contractors should develop a set of site- and mission-specific performance measures and performance indicators to demonstrate the accomplishment of performance and safety goals and to establish the effectiveness of the ISMS. These performance measures and indicators should be approved by DOE. In addition, the ISMS should include a mechanism for monitoring performance measures and indicators, validating the information by assessments, and providing opportunities for improvement in the ISMS. Those opportunities should then be reviewed and acted upon by the appropriate line manager. The activities listed below have proven to be useful in the development of ISMS performance measures and indicators: • DOE and the contractor, in conjunction with the budget cycle, should define and document the mechanisms for developing and maintaining ISMS performance objectives and criteria. From these objectives and criteria, an appropriate set of assessments, performance measures, and performance indicators can be derived. The resulting data can be used to adjust the ISMS mechanisms. If serious deficiencies with the performance indicators are uncovered, a new performance objective and related performance measures and indicators should be established for the next budget cycle. • DOE and the contractor should identify key areas that warrant measurement in the contract as performance measures or performance indicators. They should consider as CANCELE D Volume 1 - Integrated Safety Management System Guide - Page 79 Chapter III 5-27-99 DOE G 450.4-1A potential performance measures those mechanisms the contractor will use to implement the ISMS (e.g., worker involvement in hazard reviews, successful near-miss programs, effective employee concern programs, etc.). These should be agreed upon as tools to promote effective implementation of the ISMS. These identified measures are to be reviewed annually and modified to reflect improved performance. For more detailed information on developing performance measures, see How to Measure Performance, A Handbook of Techniques and Tools, U.S. DOE, Trade, which may be downloaded at http://www.llnl.gov/PBM/handbook. • DOE and contractors should obtain and review site-specific performance information demonstrating conformance to the mechanisms in place to “integrate ES&H in work planning and execution,” achieve performance objectives, and ensure overall safety performance. Target values should be developed and agreed to by both parties. The contractor would “roll up” the performance information from the facilities to support the site data. Subsequently, DOE would roll that data up to the “top-level” performance criteria established by DOE Headquarters Program Secretarial Officers’ line organizations (e.g., ER, EM, Defense Programs). • DOE Headquarters Program Secretarial Officers’ line organizations should develop performance criteria that can be linked to their field organizations. All facilities should be able to roll up their site-specific and mission-specific performance criteria into the “top- level” criteria. • DOE and the contractor should obtain and review site-specific performance information that would assist in monitoring