DOI: 10.3303/CET24111023 Paper Received: 19 January 2024; Revised: 24 March 2024; Accepted: 13 August 2024 Please cite this article as: Ab Rahim M.S., Reniers G., Yang M., 2024, Bridging Boundaries: Crafting a Resilient, Integrated Risk Management Model for Process Safety and Process Security, Chemical Engineering Transactions, 111, 133-138 DOI:10.3303/CET24111023 CHEMICAL ENGINEERING TRANSACTIONS VOL. 111, 2024 A publication of The Italian Association of Chemical Engineering Online at www.cetjournal.it Guest Editors: Valerio Cozzani, Bruno Fabiano, Genserik Reniers Copyright © 2024, AIDIC Servizi S.r.l. ISBN 979-12-81206-11-3; ISSN 2283-9216 Bridging Boundaries: Crafting a Resilient, Integrated Risk Management Model for Process Safety and Process Security Muhammad Shah Ab Rahim*, Genserik Reniers, Ming Yang Safety and Security Science Section, Faculty of Technology, Policy and Management, TU Delft, 2628 BX Delft, the Netherlands a.r.m.s.binabrahim@tudelft.nl This research explores how process safety and process security risk management methods may be integrated into a unified framework, thereby considering the resilience engineering paradigm. Employing a systematic literature review and expert surveys with industrial practitioners alongside representatives from key regulatory bodies to understand the complexities and opportunities of such integration. The interactions that result from a mixed-method study ensure the gaining of insights into the practical challenges and opportunities of integration in diverse operational and regulatory environments. Utilizing Microsoft Forms analytics tools and ATLAS.ti for qualitative analysis, the research identifies patterns and conditions, as well as the context, which is pivotal for constructing a comprehensive, adaptable risk management framework. This paper introduces a novel, holistic risk management perspective, advocating for the amalgamation of process safety and process security within the chemical industry, adopting the System-Theoretic Accident Model and Processes (STAMP) model underscored by resilience principles. Keywords: process safety; process security; resilience; risk management; STAMP 1. Introduction The chemical process industry (CPI) is a cornerstone of the global economy, inherently encompassing an array of risks due to the nature of the materials and processes involved. Traditionally, efforts to mitigate these risks have been segmented into process safety and process security measures (Amin et al., 2022). However, in an age where the intersection of these domains is increasingly evident, a paradigm shift is required—a shift towards a resilience-based approach that integrates process safety and process security into a cohesive risk management strategy (Ab Rahim et al., 2024). This paper draws upon a foundational systematic literature review and preliminary survey results to propose a resilience-based integrated framework for process safety and process security risk management. 1.1 Objective The objectives of this study are multifaceted and interrelated, focusing on (1) investigating current process safety and security practices in the CPI and their interplay with resilience-based approaches; (2) evaluating the practitioner’s familiarity and perceived utility of resilience in risk management; (3) presenting preliminary survey findings to capture industry perspectives on integrated risk management; (4) proposing a resilience-based framework informed by the System-Theoretic Accident Model and Processes (STAMP); and (5) outlining practical implications and future research directions, aiming to advance the CPI's application of integrated risk management for enhanced safety and security. 1.2 Literature Review The landscape of risk management within the CPI is intricate and multifaceted, necessitating a nuanced understanding of process safety, process security, and resilience. These domains, while distinct in their focus, converge on the common goal of maintaining operational integrity and preventing disruptions. Process safety is traditionally concerned with the prevention and mitigation of unintentional incidents (Meyer & Reniers, 2022), utilizing methods such as Hazard and Operability Study (HAZOP) and Failure Mode and Effects Analysis 133 (FMEA). Process security, on the other hand, guards against intentional malicious acts, leveraging tools like Security Vulnerability Analysis (SVA) and threat assessments (Varadharajan and Bajpai, 2023). Meanwhile, resilience adds another dimension, encompassing an organization's ability to adapt, withstand, and recover from disruptions (Hollnagel et al., 2012), whether accidental or intentional. It extends beyond preventive measures to include the capacity for adaptation and learning in the face of unexpected events (Geng et al., 2022). Despite the growing acknowledgment of its significance, resilience has not been fully integrated into risk management practices within the CPI (Pasman et al., 2020). A systematic literature review by (Ab Rahim et al., 2024) has underscored the shift towards dynamic, systemic- based risk assessment methods, notably the STAMP. This model offers comprehensive frameworks for understanding the complex interactions and variabilities within sociotechnical systems. STAMP also offers a systems-based perspective, weaving in technical, human, and organizational elements (Leveson, 2004). Its proactive strategies, emphasizing control and feedback mechanisms, align with the CPI's dynamic nature. However, there remains a gap in applying STAMP to foster resilience within the context of process safety and process security risk management in the CPI. As the CPI faces increasing complexity and interconnected risks, the imperative for a holistic framework that addresses safety, security, and resilience becomes clear. The envisioned framework would not only ensure a comprehensive understanding of potential hazards but also facilitate informed decision-making and adaptive responses to emerging threats. 2. Methodology The methodology of this study leverages a mixed-methods approach (Zou et al., 2014), beginning with a systematic literature review conducted by authors (Ab Rahim et al., 2024) and a study by (Ylönen et al., 2022), which served as the foundation for our survey instrument development. The insights from this review informed the creation of a nuanced online survey administered using the Microsoft Forms platform, targeting CPI professionals and regulatory body representatives. The survey was designed to elicit comprehensive insights into the current practices and perspectives on the integration of process safety and process security. It consisted of 31 multiple-choice questions and six open- ended questions, structured into six sections to capture diverse facets of the integration process, including respondent background, current practices, resilience awareness, regulatory perspectives, priority conflicts between safety and security, and barriers and enablers for effective integration. To ensure respondent’s uniform understanding, the survey included definitions and concepts of process safety, process security, and resilience. Sampling combined voluntary responses with snowball sampling techniques, extending invitations to the author's network and beyond. Available from 1 February to 31 March 2024, the survey was designed to ensure participant anonymity, concluding with an optional question to facilitate a seamless transition to follow-up interviews in the future. The initial analysis was performed using Microsoft Forms built-in analytics tools for quantitative data, while ATLAS.ti software was utilized for the thematic analysis of qualitative responses. This layered analysis allowed for the identification of themes, patterns, and variations in opinions across different regions and sectors, providing a rich dataset for preliminary analysis, as presented in this paper. 3. Results and Discussions 3.1 Survey Participation and Demographics The survey garnered insights from 47 industry professionals across multiple sectors of the CPI, such as industry operatives (61%), consultancies (13%), academicians (13%), and authorities (13%). As shown in Figure 1, a significant portion of the participants, accounting for 77%, were from Southeast Asia. This distribution primarily reflects the survey's outreach and circulation. Respondents also spanned various fields of work, with the majority specializing in process safety (36 respondents) and occupational safety (32 respondents), indicating a strong presence of safety-oriented roles within the sample. Experience levels among participants were diverse, yet leaned towards more seasoned professionals, with 81% having more than ten years of experience, signifying an experienced respondent base. 134 Figure 1: Demographic distributions of respondents based on main sectors, years of experience, region of work, and field of work (Note: One respondent may work in more than one field) 3.2 Attitudes Towards Integrated Risk Management Our survey yielded a rich blend of quantitative and qualitative data on professional attitudes toward integrating process safety and security. A significant 72% of respondents endorsed the merger of process safety and security into a unified management strategy, quantitatively underscoring a substantial industry consensus. This number represents numerical validation and a qualitative recognition of the intricate linkages between process safety and process security concerns. On the other spectrum, 23% of participants remain undecided, potentially reflecting a gap in understanding the full scope of process security. Nonetheless, their responses imply a willingness to embrace and explore the merits of integration as these become more pronounced. The 4% in opposition provides an essential counterpoint, highlighting the need for more compelling communication of the benefits of such a synergistic strategy. The qualitative themes extracted from the survey responses illustrate a consensus on the urgency of confronting complex risks cohesively, which is vital for bolstering industrial resilience. There is a clear acknowledgment of the potential for more effective risk management tool deployment across safety and security realms, suggesting an industry shift towards a more strategic and analytical appraisal of interconnected risks. The feedback further stresses the need for balanced protection measures against both process safety and process security threats, signaling an industry-wide movement toward acknowledging their converging nature (Reniers et al., 2020). Nonetheless, challenges such as organizational cultural variances and communication hurdles are noted, with a prevailing belief that these can be overcome through informed leadership and interdisciplinary collaboration. The survey, therefore, mirrors a broader industry trend, reflecting a dynamic and responsive risk management strategy that not only seeks to safeguard but also to evolve and flourish amidst the intertwined landscape of safety and security challenges. To this point, the survey's findings depict a progressive shift in risk management, aligning with the global landscape and technological advancement. This shift towards integrated risk management highlights a proactive stance in the industry that seeks to ensure protection while fostering the capacity to adapt and prosper in a domain where safety and security are inextricably linked. 3.3 Barriers and Enablers for Integration Our mixed-methods research, combining quantitative and qualitative data, has pinpointed key barriers and enablers for integrating process safety and security risk management within the CPI. As shown in Table 1, the predominant barriers are a lack of knowledge and awareness, insufficient resources, and collaboration between safety and security teams. These findings are reflected in qualitative feedback, which underscores competent 0 5 10 15 20 25 30 35 40 Process Safety Occupational Safety Environment Health Process/ Physical Safety Quality Assurance Cyber-security Other Industry 61% Authority 13% Academia 13% Consultancy 13% MAIN SECTOR < 5 years 4% 5-10 years 15% 11-20 years 38% 21-30 years 32% > 30 years 11% YEARS OF EXPERIENCE Europe 23% Southeast Asia 77% REGION OF WORKFIELD OF WORK Number of respondents 135 personnel and clear legal frameworks as pivotal elements that can act as both impediments and facilitators, demanding a systemic approach to expertise development and regulatory clarity. Table 1: Ranking of barriers and enablers for integrating process safety and security risk management Rank Integration Barriers Rank Integration Enablers 1 Lack of knowledge and awareness related to the integration 1 Risk reduction potential 2 Insufficient resources (e.g., time, budget) 2 Improved attitude and communication between safety and security teams 3 Lack of willingness and communication between safety and security teams 3 Increased budget allocation 4 Regulatory challenges 4 Clearer regulatory guidelines 5 Inadequate technology solutions 5 Advanced technology solutions The qualitative responses emphasize a systemic approach to creating organization-wide awareness about the enablers of integrating process safety and process security, underlining the necessity of a culture steeped in recovery and resilience. A transparent information-sharing atmosphere is recognized as crucial for integration; however, existing workplace dynamics can inhibit this openness. Moreover, the qualitative insights reveal a landscape where systemic and cultural obstacles to integration persist, yet strategic communication, regulatory support, and resource allocation emerge as significant enablers. Advancing towards integration calls for a holistic, systemic approach that encompasses regulatory reform, educational initiatives, resource investment, and organizational culture shifts. This multifaceted strategy is foundational to fostering a resilient environment conducive to integrating process safety and process security risk management, setting the stage for the STAMP- based integrated framework discussed in subsequent sections. 3.4 Core values in process safety and process security In our survey, the respondents were asked to rank which core values they perceived as more important in the context of process safety and process security (Meyer and Reniers, 2022). As summarized in Table 2, the core values in process safety and process security risk management reveal a clear prioritization of preventing and reducing risks, with "Risk Creation" and "Risk Reduction Potential" leading in process safety and process security, respectively. Process safety emphasizes environmental and regulatory compliance, placing less importance on cost, which contrasts with process security, where financial implications gain more prominence. Timing, systemic integration, and regulatory considerations are crucial in both domains, albeit with a nuanced emphasis on direct threats to security over environmental concerns. The lesser focus on "Equity" and "Fairness" may reflect a pragmatic approach in risk management, where tangible results in risk mitigation are prioritized. However, these values should not be overlooked as they embody the ethical dimensions of process operations and can influence public perception and regulatory compliance. Table 2: Ranking of core values in process safety and process security risk management Rank Values in Process Safety Rank Values in Process Security 1 Risk reduction potential 1 Risk creation 2 Risk creation 2 Risk reduction potential 3 Jurisdictional authority 3 Cost 4 Effects on the environment 4 Timing 5 Timing 5 Jurisdictional authority 6 Leverage and compatibility 6 Leverage and compatibility 7 Cost 7 Effects on the environment 8 Administrative efficiency 8 Equity 9 Equity 9 Administrative efficiency 10 Fairness 10 Fairness This analysis underscores the shared and distinct priorities in managing safety and security risks. It evidences a consensus on the criticality of risk prevention and mitigation across both domains while highlighting differences in how cost, timing, and environmental considerations are valued. Our proposed STAMP-based framework is ideally positioned to integrate these core values, offering a structured approach to analyze and manage risks that respect the nuanced priorities identified. By embracing this comprehensive view, the framework can guide 136 the development of effective risk management strategies that align with the industry's values, fostering a resilient, integrated approach to process safety and process security. 3.5 Application of the Systemic and Resilience-based Approach Our survey highlights a significant knowledge gap in the industry's understanding of resilience-based approaches, with 23% of respondents admitting a lack of knowledge and an additional 34% having only a slight familiarity. This educational shortfall is critical as it contrasts with the 57% of participants who acknowledge the value of resilience in risk management but are uncertain about its practical implementation. The gap suggests a disconnect that hinders the full application of resilience principles within the industry. The STAMP, focusing on system constraints and control structures, emerges as a potent tool to bridge this gap. It provides a structured methodology for understanding the complexities of modern CPI systems and for developing control systems that are both adaptive to change and capable of learning from system feedback (Altabbakh et al., 2014). By incorporating the STAMP model and resilience principles, we can cultivate a deeper comprehension of complex system behaviors and enhance the industry's capacity for proactive anticipation, effective response, and continual learning. Integrating the STAMP model into our proposed framework reflects the survey's call for a systematic approach to managing the intricate interplay between safety, security, and resilience. 3.6 Proposed Integrated Framework This paper proposes an integrated framework adopting the STAMP with resilience principles to address the gaps between process safety and process security risk management. Our framework, visualized in Figure 2, is designed to address the complex and intertwined risks in the CPI, as highlighted in (Ab Rahim et al., 2024) and by our survey respondents. Figure 2: STAMP-based integrated process safety and process security risk management framework Central to the framework is a dynamic and adaptive control structure that incorporates the technical and human elements identified as crucial in our survey. It accounts for the varied competencies required to understand and manage the distinct yet overlapping areas of process safety and process security, mirroring the need for competence in both domains, as suggested by industry professionals. The framework outlines values-based control mechanisms that enforce process safety and process security constraints, responsive to internal operational shifts and external environmental inputs that impact CPI operations. This systemic approach, underpinned by STAMP, ensures that the control strategies evolve with changing risk landscapes, a concept that resonates with the survey's call for improved adaptability and learning capabilities within organizations. Control Action Generation Model of Automation Values-based Model Controlled Process Controls Displays Values-based Model Controlled Process Control Algorithm Human Controller Automated Controller Actuators Sensors Controlled Process Safety & Security Procedures, Regulations, and Values Process Hazards & Threats Process Outputs Process Inputs Disturbances (Expected and unexpected) 137 In practice, the framework is intended to facilitate better risk anticipation and management, streamline decision- making, and enhance recovery from disruptions—objectives that were prioritized by survey participants. As suggested by the qualitative responses, it also aims to minimize conflicts between safety and security objectives by providing a clear, common language and understanding for risk assessment and management. While this paper provides a preliminary outline, subsequent work will delve into a detailed framework breakdown, exploring its scalability for diverse organizational contexts within CPI. Ultimately, the proposed framework strives for a safer, more secure, and inherently resilient CPI, aligning with the collective insights derived from our comprehensive survey and review of current literature. 4. Conclusions and Future Research This paper has contributed to the process safety and security field by highlighting the necessity for a resilience- based integrated risk management framework substantiated by quantitative survey results. Notably, 72% of surveyed professionals in the CPI recognize the benefits of integrating process safety and process security, indicating a significant endorsement of a unified approach. Meanwhile, the remaining responses underscore the need for further education and clarity in integrating these domains. The research has put forth a novel STAMP-informed framework that integrates the strengths of system-based risk management with resilience paradigms, aiming to tackle the complexities inherent in modern CPI systems. Despite its potential, the study acknowledges limitations, including the preliminary nature of the survey data and the initial proposed framework. Thus, future research should focus on empirical validation of the proposed framework, employing case studies within various industrial settings to evaluate its effectiveness and adaptability. Further exploration of implementation challenges, especially in diverse regulatory environments and varying organizational cultures, will provide deeper insights into the practical application of the framework. Additionally, it is crucial to develop quantitative metrics for resilience to measure the impact of the integrated approach on industry operations, thereby facilitating continuous improvement and adaptation to emerging risks. As the CPI continues to evolve, so too must our approaches to ensuring its safety and security. The proposed framework represents a step forward in achieving this goal. Acknowledgments We are thankful to all the professionals who participated in our survey and to the Department of Occupational Safety and Health Malaysia, which supported the distribution of this survey. References Ab Rahim, M. S., Reniers, G., Yang, M., & Bajpai, S., 2024, Risk assessment methods for process safety, process security and resilience in the chemical process industry: A thorough literature review, Journal of Loss Prevention in the Process Industries, 88, 1-17. Altabbakh, H., AlKazimi, M. A., Murray, S., & Grantham, K., 2014, STAMP – Holistic system safety approach or just another risk model?, Journal of Loss Prevention in the Process Industries, 32, 109–119. Amin, Md. T., Khan, F., Halim, S. Z., & Pistikopoulos, S., 2022, A holistic framework for process safety and security analysis, Computers & Chemical Engineering, 165, 1-22. Geng, S., Yang, M., & Liu, S., 2022, A Quantitative Framework for Resilience Assessment of Complex Engineered Systems under Uncertainty, Chemical Engineering Transactions, 91, 31–36. Hollnagel, E., Woods, D. D., & Leveson, N., 2012, Resilience engineering: Concepts and precepts, Ashgate Publishing Ltd. Leveson, N., 2004, A new accident model for engineering safer systems, Safety Science, 42(4), 237–270. Meyer, T., & Reniers, G. L. L., 2022, Engineering risk management, 3rd ed., De Gruyter. Pasman, H., Kottawar, K., & Jain, P., 2020, Resilience of process plant: What, why, and how resilience can improve safety and sustainability, Sustainability (Switzerland), 12(15), 1-21. Reniers, G., Landucci, G., & Khakzad, N., 2020, What safety models and principles can be adapted and used in security science?, Journal of Loss Prevention in the Process Industries, 64, 1-13. Varadharajan, S., & Bajpai, S., 2023, Chronicles of security risk assessment in process industries: Past, present and future perspectives, Journal of Loss Prevention in the Process Industries, 84, 1-15. Ylönen, M., Tugnoli, A., Oliva, G., Heikkilä, J., Nissilä, M., Iaiani, M., Cozzani, V., Setola, R., Assenza, G., van der Beek, D., Steijn, W., Gotcheva, N., & Del Prete, E., 2022, Integrated management of safety and security in Seveso sites - sociotechnical perspectives, Safety Science, 151, 1-14. Zou, P. X. W., Sunindijo, R. Y., & Dainty, A. R. J., 2014, A mixed methods research design for bridging the gap between research and practice in construction safety, Safety Science, 70, 316–326. 138 27abrahim.pdf Bridging Boundaries: Crafting a Resilient, Integrated Risk Management Model for Process Safety and Process Security