The Governance Library curated by Matthew Doyle
Risk Room · Post-Mortem
Case study · BP Deepwater Horizon
00:00
Risk Room · Case-led · Structured walkthrough
A Governance Failure
Post-Mortem
Not a blame exercise. A mechanism analysis.
A reconstruction of the chain of decisions, signals, and assumptions
that turned a manageable situation into a catastrophic one.
Not blame. Not process compliance. Not settlement.
A good post-mortem does three things.
01
Maps the chain.Every decision, in the order it was made.
02
Names the culture.The conditions that made each decision rational to the people making it.
03
Leaves a record.A document another organisation can read — without paying the same price.
20 April 2010 · Gulf of Mexico
21:56
The Deepwater Horizon, a semi-submersible drilling rig leased by BP to drill the Macondo exploration well, experiences a blowout. A geyser of drilling mud, then gas. Two explosions. Eleven workers killed. Seventeen injured. The rig burns for thirty-six hours and sinks.
87
days · oil flowing uncontrolled
4.9m
barrels · largest marine spill in history
11
workers killed
$65bn+
civil, criminal, cleanup
The forensic document
Chief Counsel's Report to the National Commission · January 2011
A bipartisan panel. 376 pages of careful, quotable reconstruction.
Bob Graham
Former US Senator · Florida · co-chair
William Reilly
Former EPA Administrator · co-chair
Four decisions · walked in the order they were made
Decision chain
1
The cement job
Halliburton's foam cement design had failed multiple lab stability tests. Halliburton's engineer Jesse Gagliano emailed the results to BP. The cement was pumped anyway. A cement bond log that would have verified the cement had set properly was ordered — then cancelled to save time and money. Roughly eleven hours of rig time · about $128,000.
↳ First missed signal
Decision chain
2
The negative pressure test
Readings anomalous. Test rerun on a different pipe. Anomalies persisted. Crew and engineers accepted an explanation called the "bladder effect" — an informal phrase not found in any industry procedure, invoked on the rig to resolve a reading that refused to behave. The test was declared a pass.
↳ Second missed signal
Decision chain
3
The gas kick
In the hour before the blowout, the well was already producing subtle signals that hydrocarbons were flowing. The rig's monitoring systems captured them. The personnel reading the screens missed them, or misread them, for roughly 50 minutes. By the time the kick was recognised, the gas was in the riser.
↳ Third missed signal
Decision chain · last line
4
The blowout preventer
Designed to sever the drill pipe and seal the well in an emergency. Batteries partially depleted. Blind shear ram failed to fully close on a drill pipe that had buckled off-centre. Emergency disconnect did not disconnect. The single piece of equipment whose function was to make a blowout survivable — did not.
↳ Fourth missed signal
Four decisions. Each defensible on its own.
None catastrophic in isolation.
Cement
→
Pressure test
→
Gas kick
→
BOP
Together — eleven lives and the largest marine oil spill in history.
The mechanism
Normalisation of deviance
Diane Vaughan · The Challenger Launch Decision · 1996
At NASA, engineers watched O-ring erosion on shuttle boosters for years. Every launch without a catastrophic failure taught them the erosion was tolerable. Each missed signal at Macondo was the same kind of small normalisation.
The deviance was already the norm — because it had been the norm for long enough.
The confusion
BP celebrated one, and quietly confused it with the other.
Record low
Personal safety
Cuts. Slips. Trips. Falls. A workforce that avoids sprained ankles.
Not measured
Process safety
Preventing catastrophic events. Can be one step away from a blowout.
Trevor Kletz · British chemical engineer · founder of modern process safety
The precedent
2005
BP Texas City refinery explosion · 15 killed
The investigation, led by James Baker — former US Secretary of State — identified exactly this conflation of personal with process safety as a cultural root cause. The Baker Panel Report's recommendations were accepted by the BP board.
Five years later — the same confusion produced Deepwater Horizon.
Each missed signal had the same cultural pattern.
A crew that expected its equipment to perform.
A head office that expected its crew to report cleanly.
A board that expected its management to raise bad news.
A management that expected low personal injury rates to speak for the rest of the system.
Four decisions. One culture. One normalisation.
A mechanism, not a villain.
That is what a governance post-mortem should look like — a record another board, in another sector, can read and recognise.
The critique
Post-mortems decay.
The Chief Counsel's Report exists. It is read. But the process-safety culture it was written to change is, fifteen years later, still patchy in the industry it was written for. Post-mortems only matter to the organisations that do the work of rereading them.
Three things to carry forward.
A reading
The Chief Counsel's Report to the National Commission on the BP Deepwater Horizon Oil Spill, January 2011. 376 pages. Pair it with Vaughan's The Challenger Launch Decision for the theoretical frame.
A question
What is your organisation's personal-safety-meets-process-safety confusion? Where is the thing you measure well, silently standing in for the thing you don't measure at all?
The wider library
A post-mortem — what happened.
Three Lines — who should have caught it.
Appetite · Tolerance · Oversight — the surrounding system.
Risk Room 04 · The Governance Library curated by Matthew Doyle · mæd partners
00:00 · 08:00