Buncefield: the lesson we still need to learn about assurance

Twenty years ago, the Buncefield explosion shook confidence across industry. A storage tank was overfilled. A vapour cloud formed and ignited with enormous force. Fires burned for days. The disruption and environmental impact lasted much longer.

Controls and procedures existed, but the protections that mattered most were not proven to work. When they were needed, they failed. This was not a lack of knowledge. It was a lack of assurance.

The real danger was the assumption that normal operation meant safe operation.

At Buncefield, a critical level trip was not functioning. A gauge was unreliable. The control system hid key information. Communication between shifts broke down. Everything looked normal until it wasn’t.

Major accidents often start this way. Weak signals hidden inside familiar work.

There has been real progress. Stronger major incident coordination. Clearer expectations for leadership. More constructive collaboration with regulators.

But the operating environment has changed in ways that increase risk:

• Hydrogen, carbon capture and large-scale batteries introduce new technologies, behaviours and failure modes.
• Automation distances operators from the process and reduces opportunities to spot weak signals.
• Leaner staffing and outsourced services stretch capacity, coordination and continuity.
• Ageing assets rely increasingly on temporary fixes.
• Supply chains are more complex and fragmented.

These shifts make assurance more important, not less. A quiet day only proves that failure has not yet surfaced.

“Most major accidents come from something familiar that has quietly stopped working.”

The Loss Prevention Bulletin’s anniversary reflections highlight essential checks. They are simple questions, but require evidence behind the answers:

• Do we understand our major accident risks and the barriers that control them?
• Are those barriers dependable and properly maintained?
• Do audits reveal how work is really done?
• Are suppliers and maintainers meeting the standards safety depends on?
• Does change avoid degrading protection?
• Do people have sufficient capacity to operate safely?

If answers rely on belief rather than verification, the organisation is exposed.

Assurance is the continual act of checking whether protections still perform in real conditions. It identifies drift early. It prevents silent erosion of safety margins. It keeps decisions grounded in evidence, not optimism.

It is how leaders remain certain that safeguards will work when it matters.

The strongest duty holders make assurance part of everyday operation. They know what is safety critical, track its condition explicitly, act early on weak signals and ensure improvements are made.

That is the heart of our approach. Helping operators demonstrate that essential controls remain intact as conditions, assets and pressures change. Nothing complex. Just disciplined focus on what keeps people safe.

Buncefield is not a case study to file away. It is a reminder that major incidents often begin with small, known deviations. A faulty instrument. A workaround. A problem that becomes part of normal operations. Normal operation is not proof of safety.  Stability can hide drift.  Assumptions can leave you unprotected.

Assurance – or more precisely, a lack of it – might be the difference between a normal shift and a national-scale event.