Why Risk Assessments in Oil & Gas Are Mostly Theater
The uncomfortable truth about the documents that are supposed to keep people alive — and what it actually takes to fix them.
There is a ritual that plays out at worksites across the GCC every single day.
A job gets scheduled. An HSE coordinator opens a shared drive, finds last year’s risk assessment for something that looks similar enough, changes the date, swaps a couple of hazard descriptions, prints it out for signatures, and files it in a binder. The work begins. The document is never consulted again.
Nobody who works in oil and gas or construction will be surprised by this description. They have either done it themselves or watched colleagues do it hundreds of times. It is not laziness. It is not malice. It is the rational response to a system that demands compliance paperwork at a volume and speed that makes genuine risk assessment impossible.
The result is that the documents meant to prevent incidents have become the documents used to defend companies after incidents. The risk assessment binder moves from the site office to the investigation room. The controls that were never actually implemented get scrutinized. The signatures that were obtained in two minutes get questioned.
This is the cycle. And it has been running for decades.
The Three Structural Failures
Understanding why risk assessments fail at scale requires looking at the process honestly, not defensively.
Failure 1: They are disconnected from the specific job.
A scaffold erection risk assessment written for a maintenance shutdown at a refinery in Jubail gets copied for a scaffold erection job at a gas compression station 400 kilometers away. The hazards look similar on paper. The controls look reasonable. But the differences that actually matter — the proximity to live process equipment, the specific H2S exposure profile of that facility, the elevation and wind conditions, the competency history of that specific subcontractor, the permits already active in that area — none of this is captured.
Generic hazard descriptions produce generic controls. And generic controls produce generic behavior. When a worker reads “wear appropriate PPE,” nothing changes. When a worker reads “wear 30-minute SCBA when working within 50 meters of the MP-12 flare header during hot work operations between 0800 and 1600 hours,” something changes. The specificity is the mechanism. Without it, the RA is a form, not a tool.
Failure 2: Institutional knowledge evaporates.
The experienced HSE manager who has worked a specific facility for seven years knows things that are not written anywhere. He knows which valve configuration caused a near-miss two years ago. He knows which contractor consistently cuts corners on gas testing. He knows which area of the plant has historical issues with simultaneous operations that show up in incident reports but never made it into the formal RA library.
When that person leaves — and people leave — that knowledge leaves with them. The company’s RA templates reflect what was known when they were written, not what has been learned since. Most organizations have no systematic way to feed operational learning back into their hazard identification process. The gap between what the templates say and what the facility has actually experienced grows wider every year.
Failure 3: Quality collapses under volume.
A genuinely competent HSE manager can write a rigorous, specific, useful risk assessment for a job type he understands deeply. He can do this for five or six tasks in a day with sustained quality.
Large projects don’t have five or six concurrent work packages. They have forty. They have simultaneous scaffold erections, confined space entries, hot work operations, crane lifts, and electrical isolations, all running at the same time, all requiring their own documentation, all needing to be reviewed and approved before work begins. The math does not work. The only way to hit the volume is to sacrifice quality, and sacrificing quality on risk assessment is how people get hurt.
These three failures are structural. They are not fixed by training courses or management commitment speeches. They require changing the process itself.
What AI Changes — And What It Doesn’t
The conversation about AI in HSE management tends to split into two camps. One camp says AI will transform everything; the other says it’s hype that will never replace human judgment.
Both are wrong.
Get SmartQHSE’s stories in your inbox
Join Medium for free to get updates from this writer.
AI does not replace HSE expertise. An experienced safety engineer who understands process hazard analysis, human factors, and the specific failure modes of GCC offshore and onshore operations is irreplaceable. AI cannot substitute for that judgment.
What AI can do is eliminate the three structural failures described above — not by replacing humans, but by doing specific things that humans structurally cannot do at scale.
It makes RAs specific without requiring hours of work.
AI systems trained on a company’s incident history, near-miss reports, equipment data, and regulatory libraries can generate controls that are specific to the actual job rather than a generic category. Not “ensure adequate ventilation” — but “classified as confined space Type B per NFPA 350, continuous oxygen monitoring required, minimum 4-hour purge before entry, SCBA staged at entry point, rescue tripod with retrieval winch required given 4.2-meter depth.” The specificity comes from the system knowing what this type of space has required before and what the applicable standard actually mandates.
It preserves and surfaces institutional memory.
Every time a job is completed, every time an incident or near-miss occurs, every time a corrective action is closed, the AI system learns what happened and why. The next RA for a similar job in a similar environment reflects that learning. The knowledge that used to walk out the door when the experienced HSE manager left is now embedded in the
system. It compounds over time.
It handles volume without sacrificing quality.
An AI-assisted RA workflow can produce a draft assessment — specific, regulatory-compliant, rooted in historical data — in minutes rather than hours. The HSE professional’s job shifts from writing from scratch to reviewing, challenging,
and approving. The total time per RA drops dramatically. Quality is maintained because the system never gets tired,
never copies last year’s document out of deadline pressure, and never misses a regulatory requirement because it forgot to check.
Platforms like https://www.smartqhse.com are building this directly into the RA workflow — industry-adaptive https://www.smartqhse.com/features/risk-assessment that pull from past incident data, auto-scope controls to the
applicable regulatory framework (GCC-specific: Saudi Aramco HSEMS, ADNOC OHC, TRAKHEES, RAKEZ, ISO 45001), and
generate documentation at the specificity level that actually changes what happens on the ground.
The difference in output quality compared to a copied template is not marginal. It is the difference between a document that gets filed and a document that gets used.
The Benchmark Companies Are Using
The organizations that have made genuine, sustained progress on incident rate reduction share a characteristic that has nothing to do with technology: they treat the risk assessment as a working document, not a compliance artifact.
The RA is reviewed at the toolbox talk. It is updated when conditions change. It is the reference workers actually consult when something unexpected happens. It is living documentation.
Getting to that point requires two things simultaneously: documents good enough that workers trust them, and a process fast enough that workers can actually update them in the field without creating a bureaucratic nightmare. Traditional manual workflows can rarely do both at once. Either you take the time to produce something genuinely good, or you produce something fast enough to keep up with operations.
AI-assisted processes are the first approach that can genuinely do both.
The Question Worth Asking
Every HSE audit in the GCC asks some version of the same question: do your documents reflect your actual operations? The honest answer at most organizations, most of the time, is no.
That gap — between what the RA says and what actually happens on the job — is where incidents live. It is filled by assumptions, habit, and institutional memory that exists only in the heads of people who might not be there next year.
ISO 45001 certification is not the goal. It is the floor. The goal is a system where the documents and the reality actually match — where the risk assessment that a crew reviews before entering a confined space reflects the actual conditions of that space, the actual competency of that crew, the actual regulatory requirements that apply in that jurisdiction, and the actual failure patterns that facility has experienced before.
That system is now buildable. It was not five years ago.
The question is not whether AI has a role in making risk assessment work. The question is how long organizations will
continue to run a process that everyone in the room knows is theater, when the alternative is available.
SmartQHSE is an AI-powered HSE management platform built for oil & gas and construction teams across the GCC. The platform includes https://www.smartqhse.com/features/risk-assessment, incident management, permit-to-work, audit management, and ARIA — an AI copilot trained on GCC regulatory frameworks including Saudi Aramco HSEMS, ADNOC OHC, TRAKHEES, and ISO 45001/14001. Start at https://smartqhse.com.
