1. Understanding the “ALARP” Headache (and Why It Shows Up at the Worst Time)
If you’ve ever tried to close out a HAZOP, you’ll know the moment. The workshop ends, actions pile up, and then someone says: “But is that ALARP?” Suddenly you’re not just finishing actions, you’re defending decisions, budgets, and sometimes a whole legacy plant design.
This article unpacks how to apply ALARP in process safety for UK sites, especially when you’re trying to close HAZOP actions and justify changes on existing plant.
1.1 Why ALARP becomes a “can of worms” in HAZOP close-out
ALARP debates usually explode when there’s a gap between what could be improved and what is realistically implementable. It’s the difference between “in an ideal world” and “in the world where shutdown windows exist, space is limited, and change creates new hazards.”
1.1.1 The classic trap: “We’ve always operated like this”
Legacy operation can feel like evidence of safety but it’s not a guarantee. A quiet history might simply mean you’ve been lucky, or that near-misses weren’t captured, or that layers of protection are being silently eroded over time.
2. What ALARP Actually Means in the UK
ALARP stands for As Low As Reasonably Practicable. In UK terms, it links closely to the duty to reduce risk “so far as reasonably practicable” (SFAIRP). (HSE)
2.1 ALARP and “SFAIRP”
SFAIRP is rooted in UK health and safety law and has been shaped by legal judgement (often referenced through case law discussions in HSE guidance). The practical takeaway is simple:
You should reduce risk unless the sacrifice (money, time, trouble) is grossly disproportionate to the risk reduction achieved. (GOV.UK Assets)
2.1.1 Why “gross disproportion” matters
This is where many teams get stuck. ALARP is not a neutral “cost equals benefit” spreadsheet. There’s a bias toward safety, and for a measure to be rejected, the cost-to-benefit imbalance should be gross, not marginal. (HSE)
3. ALARP is a Demonstration
ALARP isn’t won by confidence or seniority. It’s won by evidence. You’re showing that you:
- Identified credible hazards,
- Considered reasonably practicable safeguards,
- Compared the sacrifice against the risk reduction,
- And documented why the final position is defendable.
3.1 Evidence you need to show a decision is defensible
A good ALARP demonstration typically includes:
- Clear scenario descriptions (from HAZOP or equivalent),
- A risk picture (often strengthened through LOPA),
- Options considered (including why some were ruled out),
- Cost and implementation impacts,
- The reasoning trail to your decision.
3.1.1 What “good practice” can do (and can’t do)
If an improvement is recognised good practice, you’ll have a hard time arguing it’s not reasonably practicable. But if you’re outside clear industry norms, that’s when structured ALARP decision-making earns its keep for tricky retrofit situations.
4. Where ALARP Fits in the Design Lifecycle
ALARP shows up throughout the lifecycle, but the conversation changes depending on timing.
4.1 New design vs. late-stage change
In early design, you have flexibility. Late-stage? Every tweak feels like pulling a thread in a jumper and suddenly the sleeves fall off.
4.1.1 The cost-of-change curve: cheap early, painful late
The earlier you address risk, the cheaper and cleaner it usually is. That’s why ALARP thinking should start before the “final layout” is treated like a sacred artefact.
5. Retrospective ALARP on Existing Plant
This is where the “can of worms” really opens.
5.1 Why retrofits feel unfair (but still matter)
Operators often say: “This plant was built years ago. Standards have moved on.” True but major hazards don’t care about the commissioning date. And for higher hazard sites, regulators expect robust change control and risk assessment around modifications.
5.1.1 When “legacy” isn’t a justification
If a credible scenario can cause serious harm, the real question becomes:
- What is the current risk?
- What options exist to reduce it?
- Which are reasonably practicable today?
6. Common Misconceptions That Derail ALARP
6.1 “If it passed HAZOP, it must be ALARP”
HAZOP identifies issues. ALARP is about deciding what to do about them. You can have a thorough HAZOP and still end up with weak close-out logic if you don’t quantify risk and evaluate options properly.
6.2 “ALARP means zero risk”
Nope. ALARP means you’ve reduced risk as far as is reasonably practicable not to zero. Some residual risk is tolerated because society benefits from industrial activity, but it must be properly managed.
6.2.1 The reality: tolerable, not perfect
Think of ALARP like fitting seatbelts and airbags. You don’t make driving “risk free,” but you do make it hard to justify skipping proven protection.
7. A Risk-Based Approach to Design Improvements
This is the approach IDEA has been using with clients to decide whether design improvements to existing plant are required — on a cost vs. benefit basis — and to build a strong, HSE-aligned justification.
7.1 Step 1 — Identify credible scenarios via HAZOP
Start with real scenarios:
- What initiates the event?
- What are the consequences?
- Who is exposed?
- What safeguards exist today?
7.1.1 Getting the scenario quality right
Garbage in, garbage out. A vague scenario leads to vague decisions. Strong scenarios have clear initiating causes, defined consequence pathways, and realistic operating contexts.
7.2 Step 2 — Quantify risk using LOPA
LOPA (Layers of Protection Analysis) helps turn “I think” into “here’s the risk profile.” It’s not magic, but it’s an excellent bridge between qualitative HAZOP discussion and decision-grade evaluation.
7.2.1 Turning debate into numbers (carefully)
The point isn’t to pretend the numbers are perfect. The point is to compare options consistently and highlight where risk is genuinely high versus where it’s just uncomfortable.
7.3 Step 3 — Generate improvement options
This is where multi-discipline engineering earns its keep. Options might include:
- Instrumented protections (alarms, trips, interlocks),
- Relief, venting, containment,
- Mechanical integrity upgrades,
- Layout and segregation improvements,
- Operating procedures and competency controls,
- Detection and emergency response enhancements.
7.3.1 Multi-discipline design options that actually work
A safeguard that looks great on paper can fail in the real world if it ignores maintainability, operability, proof testing, or human factors. The “best” option is the one that survives day-to-day plant life.
7.4 Step 4 — Estimate CapEx, OpEx and operational impacts
Now you cost it properly:
- Capital spend (equipment, installation, civils),
- Operational costs (energy, consumables),
- Maintenance and proof testing burden,
- Downtime/shutdown implications,
- Training and competence requirements.
7.4.1 Don’t forget “hidden” costs and constraints
Space constraints, ATEX/DSEAR implications, tie-in complexity, temporary works, permit burden — these often decide whether something is truly practicable.
7.5 Step 5 — Apply cost–benefit principles
This is the ALARP heartland: balancing sacrifice and risk reduction with a bias toward safety, recognising the concept of gross disproportion in the UK approach.
7.5.1 “Grossly disproportionate” in plain English
Ask: “If this safeguard prevents a severe harm scenario, is it really reasonable to reject it because it’s inconvenient or moderately expensive?”
Sometimes the answer is yes — but you need to prove why, not just say it.
7.6 Step 6 — Identify the maximum justifiable spend
Here’s a powerful trick: rather than arguing endlessly about one option, determine the upper spend boundary that would still be justified for the risk reduction.
7.6.1 Why this unlocks smarter brainstorming
Once the client knows the “budget ceiling” for justification, teams can creatively explore alternatives within it — often finding solutions that are safer, simpler, and easier to implement.
7.7 Step 7 — Document a robust ALARP demonstration
This is where you build the defence:
- Scenario summary and assumptions,
- LOPA basis and outcomes,
- Options list (including those rejected),
- Costing basis and practicality constraints,
- The ALARP decision logic and conclusion,
- Residual actions, monitoring, and review plan.
7.7.1 What a good ALARP pack includes
If you can hand it to a technically competent third party and they can follow the logic without you in the room — you’re doing it right.
8. Practical Tips for Closing HAZOP Actions Using ALARP
8.1 Sorting actions: must-do, should-do, nice-to-have
Not every action is equal. One useful way to triage is:
- Must-do: clear good practice / compliance / intolerable risk drivers,
- Should-do: strong risk reduction with manageable sacrifice,
- Nice-to-have: marginal reduction or speculative benefit.
8.1.1 Avoiding “analysis paralysis”
ALARP can become a rabbit hole if you try to over-engineer low-risk issues. Keep the depth of analysis proportional to the hazard — and spend your effort where it genuinely protects people.
9. A Simple Example (Without the Maths Overload)
9.1 From scenario to decision
Imagine a credible overpressure scenario on an existing system:
- HAZOP identifies the cause and consequence path.
- LOPA shows the current risk is higher than the organisation is comfortable tolerating.
- Options include a new independent trip, upgraded relief arrangements, or a redesign of a problematic operating mode.
- Costs vary, and the shutdown window is tight.
9.1.1 How the conclusion becomes defendable
Instead of picking your favourite option, you:
- quantify the risk reduction each option delivers,
- cost the true sacrifice (including downtime and maintenance),
- compare sacrifice vs benefit with the UK “gross disproportion” mindset,
- document the decision and the residual risk management plan.
Now, if challenged, you’re not saying “we felt it was fine.” You’re saying “we assessed it systematically and reduced risk as far as reasonably practicable.”
10. Why Multi-Discipline Matters (More Than People Think)
10.1 Design measures fail when they ignore operations
The fastest way to create a false sense of safety is to install a safeguard nobody can maintain, test, or operate properly.
10.1.1 The “paper safeguard” problem
A safeguard that exists only in drawings, not in reality, is worse than useless, it can encourage risky operation because people believe they’re protected.
That’s why combining design, process safety, HAZOP facilitation, and LOPA quantification under one roof is so effective: it keeps decisions grounded in real plant life.
Conclusion
ALARP doesn’t have to be a can of worms. When you treat it as a structured demonstration, it becomes a practical decision tool. By combining high-quality HAZOP scenarios, LOPA-based risk quantification, realistic option development, and cost–benefit thinking that recognises the UK “gross disproportion” principle, you can make upgrade decisions that protect people and stand up to scrutiny.
If you’re struggling to close out HAZOP actions, justify retrofit spend, or build a robust ALARP defence for an existing plant, IDEA can help from facilitation and LOPA through to option design, costing, and a clear decision pack you can stand behind. Get in touch to discuss whether your risks are ALARP.
FAQs
1) Does ALARP mean we must implement every possible safeguard?
No. You must implement safeguards that are reasonably practicable. If the sacrifice is grossly disproportionate to the benefit, the measure may be rejected but you need a clear, documented justification.
2) Can we use ALARP to close a HAZOP action without doing LOPA?
Sometimes, yes especially for obvious good-practice items. But where the decision is contentious, a LOPA-style quantification often makes the conclusion far more robust and less opinion-driven.
3) How do you apply ALARP to old plant that was designed to older standards?
You focus on today’s credible hazards and today’s practicable options. “It’s old” may explain how you got here, but it doesn’t automatically justify staying here particularly where the consequences are severe.
4) What does a strong ALARP justification look like?
It clearly shows: (1) the scenario and current risk, (2) options considered, (3) costs and practicality constraints, (4) the reasoning trail using cost–benefit thinking with a safety bias, and (5) the final decision with residual risk controls.