Why Process Safety Management Programs Fail Even When OSHA Boxes Are Checked

In 2005, an explosion at BP’s Texas City refinery killed 15 people, injured more than 170, and produced losses measured in the billions—asset damage, lost production, penalties, and settlements. Investigators did not point to one broken valve. They pointed to breakdowns across procedures, training, and operational controls—the same territory covered by OSHA’s Process Safety Management standard.

Two decades later, most high-hazard sites can show a PSM binder. Serious events still happen, including a March 2026 refinery explosion in Port Arthur, Texas. The uncomfortable pattern is familiar: the 14 elements exist on paper, but they are not connected, not current, and not aligned with how the unit actually runs.

In continuous-process facilities, safety performance is decided by whether documented controls still match the equipment, people, and contractors on shift—not by how complete the filing cabinet looks.

Compliance theater versus an operated system

PSM is built from 14 elements. It does not behave like 14 independent chores. Effectiveness comes from how those elements are applied, linked, and sustained. The most common failure mode is managerial: treating PSM as requirements to satisfy rather than a system to operate.

Hazard analyses, procedures, training, and maintenance programs may all look complete. When they are not connected or not maintained together, gaps open quietly. Because those activities rarely show up as daily throughput, short-term production pressure wins. Over time the program becomes documentation about work—not a faithful description of work.

Drift shows up first as stale procedures, lagging drawings after equipment changes, and delayed audits or reviews. None of those gaps looks catastrophic alone. Together they mean the “compliant” program no longer describes current conditions.

Control rooms expose the gap fastest: operators execute what the plant allows, not what last year’s procedure claimed.

Investigations that stop at the injury count

Incident investigation often scales with outcome. Near misses get a light touch; serious events get depth. The underlying causes can be identical. Ranking events by potential consequence and recurrence likelihood gives a clearer picture of exposure than waiting for blood on the floor.

What happens after the report matters more than the report’s length. If findings never rewrite procedures, training, or system configuration, the same conditions remain armed. Plants that treat learning as optional paperwork recycle the same scenarios under new dates.

Contractors and the blind spot outside the fence

Contractor management imports a second risk profile. A contractor’s corporate safety program may be genuine—and still misaligned with a PSM-covered facility’s expectations. Those mismatches are easy to miss until mobilization. Pre-bid meetings, bid clarifications, and pre-mobilization planning are where EHS expectations have to be forced into the open. Without that alignment, differences in planning and execution become latent energy in the permit-to-work stack.

Hardware and software layers that enforce trips, alarms, and permissive logic sit in the same integrity story. Teams that keep installed bases healthy often start from platforms already on site—whether that means browsing Honeywell control hardware for process and safety-adjacent architectures, or confirming rotating-asset protection paths through machinery protection instrumentation when vibration and overspeed functions must stay independent of ordinary process logic.

High-hazard sites rarely fail from a missing binder section; they fail when small misalignments accumulate until a safeguard no longer does what the risk assessment assumed.

Visibility: audits that measure performance, not binders

Many organizations cannot answer a simple question: how well is PSM performing right now? Completeness of documents is not performance. Compliance audits—required at least every three years—and structured gap assessments create a baseline for prioritizing fixes. Without that cadence, “improvement” stays reactive: another incident, another temporary action item, another forgotten owner.

Across these failure modes the pattern is consistent. Breakdowns rarely arrive as a single missing element. They accumulate as the living plant moves and the written system does not. Safeguards then look intact while their real-world effectiveness decays.

The operational verdict

Checking OSHA boxes proves you can assemble evidence. It does not prove you can prevent the next loss-of-containment event. An effective PSM program needs clear performance visibility, ranked gaps, and follow-through that rewrites how work is done—procedures, training, contractor interfaces, and the control layers that enforce them.

When those risks are neither understood nor managed, small disconnects escalate. The binder still looks compliant. The plant does not.