Process safety is often scenario-driven. What could go wrong, how severe it could be, and what measures are needed in response? But when audits and assessments are dominated by the concept of “maximum credible events” (MCE), they risk becoming narrow, reactive, and ultimately misleading.
Worse still, when organisations audit only for the risks they can most easily imagine, quantify, or visualise, they fall into a form of risk blindness—overemphasising the visible and modelled, while neglecting the subtler indicators of system degradation. This is the “lamplight approach”: looking only where the light shines brightest, not necessarily where the real problems lie.
Where Maximum Credible Events can mislead audits
The MCE, defined as the worst-case but still credible event, has long been a useful tool for guiding emergency preparedness. But when used as the primary lens for evaluating process safety performance, it can become a dangerous distraction.
Audits that focus narrowly on MCE scenarios often overlook the underlying systemic weaknesses that may not feature in a catastrophic scenario, but are far more likely to occur and repeat. These include procedural workarounds, missed inspections, or ineffective supervision. Failures that don’t grab headlines but chip away at the system’s integrity.
Without a systems thinking approach, auditors risk failing to recognise that systemic failures are not separate from MCEs. They are their precursors. A maximum credible event rarely emerges from nowhere. It is almost always preceded by a series of smaller, overlooked breakdowns in barriers, controls, and decision-making processes.
Why this undermines process safety
While MCEs help visualise extreme consequences, true process safety management is about how systems perform in the everyday. Audits that only examine whether a site is prepared for a single major scenario miss the deeper question: Is the system resilient enough to prevent that scenario in the first place?
Focusing an audit solely on headline risks ignores the smaller, recurring breakdowns that signal deeper design or cultural issues. These include missed isolations, inconsistent maintenance practices, permit-to-work shortcuts, and informal overrides. Each of these might seem minor in isolation, but together they are the conditions in which an MCE becomes possible.
A site will hopefully never experience its modelled MCE. Yet, if it suffers regular deviations or uncorrected near misses, it is telling you something vital: the system is under stress, and that stress will eventually find its outlet.
Auditing for system health, not just scenario preparedness
Effective audits must go beyond the “what if” of MCEs and investigate how systems actually function. This requires a deliberate shift from scenario-based thinking to systems thinking: asking not just “What could go wrong?” but “What is going wrong. And why?”
This means:
- Looking beyond isolated worst-case scenarios
- Examining how well controls are implemented and sustained in day-to-day operations
- Investigating weak signals and near misses as indicators of system health
- Assessing decision-making, communications, and feedback loops
- Testing for conditions where failures could propagate—even if they haven’t (yet)
Audits should challenge not only whether the site is ready for the worst-case, but whether it is set up to prevent the conditions that give rise to it.
A better way forward
Rather than auditing solely against maximum credible events, organisations should evaluate the full spectrum of system performance. Techniques like Bowtie analysis, STAMP-based audits, and control-structure reviews grounded in systems thinking help reveal where defences are degrading, often in places traditional audits miss.
Critically, leaders and auditors must cultivate a mindset of curiosity, not just compliance. The most valuable audit questions are often the most basic: “Where are we relying on luck?” “What doesn’t work as intended?” “What patterns are emerging across events?”
Conclusion
The real world does not operate within the boundaries of a single worst-case scenario and neither should your audits. Risk is not just about what might go wrong, but about the conditions that allow things to go wrong and remain unnoticed.
Without systems thinking, process safety audits can miss the very weaknesses that, left unchecked, evolve into MCEs. To prevent the catastrophic, we must learn from the routine. And to manage risk effectively, we must look beyond the immediate, into the system itself.
For more information about OpenPSM click here