How to Build Compliance and Reduce Risk in Oil and Gas Commissioning

Commissioning is one of the most important phases in an asset’s lifecycle. It marks the point where design intent meets operational reality, and where many long-term risks first become visible. The performance of critical systems is verified, tolerances are tested, and any gaps between “as designed” and “as built” are brought to the surface. 

But it is also a phase shaped by pressure. Projects are behind schedule. Operations are waiting to take over, and in that environment, decisions are made quickly. This results in temporary workarounds being put into place, with deviations marked as acceptable for start-up and unresolved issues pushed to follow-up lists. Along the way, assumptions begin to form. 

This is where the problem begins. 

Most failures do not start with a catastrophic event. They start with these assumptions. That something was checked. That someone followed up. That a minor gap would be addressed after handover. These moments are rarely dramatic, but they set the stage for what comes next. 

When risks identified during commissioning are not carried forward into operations, they tend to disappear. Not because they were hidden or ignored, but because there’s often no structured process to carry them forward once the system goes live. And when that happens, it does more than create technical blind spots. It also undermines the ability to demonstrate compliance later on. 

Even when commissioning is done well, and risks are clearly identified, that does not guarantee they will be acted on. In fact, this is one of the most fragile points in the lifecycle of an asset. The transition from project delivery to operations is where insight often fades, responsibility becomes blurred, and assumptions are quietly allowed to stand. 

What gets lost here is not information. It is visibility. The data exists in handover reports, punch lists, and deviation registers. But the process to carry it forward is often inconsistent, informal, or missing altogether. This is not a matter of negligence. It is a matter of structure. This lack of structure not only weakens operational follow-through but also makes future compliance harder to demonstrate. 

Handover is not just a change in responsibility. It is a shift in mindset. Project teams are focused on completion and delivery. Operations teams are focused on uptime and performance. Both sides act in good faith, but they are working toward different goals. 

Without a clear structure, ownership of risk becomes blurred. Items flagged during commissioning fall into the gap. No longer part of the project, not yet prioritized by operations, and without a process to carry them across, they often remain unresolved. 

It is easy to assume that if something is documented, it will be handled. Commissioning reports contain pages of observations and open actions. But documentation alone is not enough. 

If these risks are not linked to the systems that drive inspections or maintenance, they are practically invisible. Unless someone reviews and acts on them, they stay in the background, disconnected from daily decisions. 

This creates more than just operational risk. It also creates a compliance problem. When issues are documented but not tracked or closed, there is no clear line of sight into how risks were managed. Compliance requires more than evidence of identification. It requires evidence of action. 

Once operations begin, there is often no consistent way to track whether a flagged issue from commissioning was ever closed. No alerts. No updates. No follow-up. 

The link between early warning and long-term integrity breaks. Not because people failed to act, but because the system failed to follow through. 

When commissioning risks are not carried forward, the impact is not always immediate. But over time, small decisions accumulate. Assumptions become defaults. And when conditions change, no one is watching closely enough to respond. 

One of the most cited examples in the UK is the Buncefield explosion in 2005, where overfilling of a fuel tank led to a massive vapour cloud and a series of explosions that injured dozens and caused widespread damage. Investigations found that level instrumentation had failed multiple times before the incident. Warning signs were present. But follow-up was inconsistent, and assumptions about system status went unchallenged. 

The problem was not that no one knew about the risk. It was that no one had clear responsibility for seeing it through. A series of deferrals, overrides, and missed maintenance decisions created the conditions for failure. 

This is what happens when engineering risk is treated as a one-time concern rather than a continuous input. When handover is treated as closure, rather than transition. 

This is what can happen when engineering risk is treated as a one-time concern rather than a continuous input. When handover is treated as closure, rather than transition. 

Incidents like Buncefield are not only operational failures. They are also compliance failures. In Europe, events of this scale fall under the scope of major accident prevention regulations such as SEVESO and COMAH. These frameworks require operators to demonstrate that risks are systematically identified, managed, and monitored over time. When engineering insight is not carried forward beyond commissioning, it becomes difficult to show that this duty has been fulfilled. The cost of that gap is measured not just in fines, but in loss of trust, safety, and long-term viability. 

Preventing future failures does not begin with audits or inspections. It begins during commissioning. This is when early warnings are most visible, and when organisations still have the chance to act on them before they are absorbed into routine operations. 

To avoid losing that insight, risks identified during commissioning need to be treated as live inputs, not closed items. Temporary workarounds, conditionally accepted deviations, and incomplete follow-ups should be linked to clear owners, embedded in operational systems, and tracked beyond handover. This is not about doing more paperwork. It is about making risk harder to forget. 

The goal is to remove reliance on memory or goodwill. To stop treating commissioning as the end of a project and start treating it as the beginning of asset ownership. When organizations do this well, integrity is not left to chance. It is built in from the moment the system goes live. 

A structured approach to commissioning integrity includes: 

The good news is that once risks are transferred out of handover files and into structured systems, they no longer depend on memory, spreadsheets, or informal follow-up to be managed. The most effective way to embed commissioning insight into long-term decision-making is to use software purpose-built for managing engineering risk across the asset lifecycle. 

If you are trying to prevent integrity issues, reduce operational risk, or improve compliance outcomes, it starts with how you manage commissioning follow-through. Most breakdowns happen not because teams missed the problem, but because they lacked the structure to carry risk forward into operations. 

That is where structured asset integrity software can make the difference, especially when it is designed to manage risk across the entire asset lifecycle. 

Cenosco’s IMS Suite is an enterprise-grade, cloud-based asset integrity management solution. It provides the structure needed to manage risks identified during commissioning, once they are captured and transferred into the system, and to connect them with the decisions that drive operational performance. 

The key is to ensure that commissioning risks are not left behind in handover files, but carried forward into IMS where they can be tracked, reviewed, and closed out over time. 

Here’s how IMS helps strengthen integrity from commissioning onward: 

Risks identified during commissioning often remain buried in handover files. When they are transferred into IMS, they can be linked directly to inspections, maintenance, and monitoring workflows. This helps ensure they stay visible beyond start-up.  

When projects end, accountability often gets lost. IMS assigns clear ownership to every risk, deviation, and action, so nothing falls through the cracks as teams shift. 

Capturing the risk is not the problem. Acting on it is. IMS turns static reports into live tasks by integrating with the systems used to manage day-to-day work, ensuring that risks are not just recorded but resolved. 

Risks evolve as conditions change. IMS makes it easier to revisit earlier decisions, review assumptions, and adjust actions based on new data. 

IMS provides a full history of decisions, ownership, and actions, so compliance is not just a matter of documentation. It is the outcome of a process that was traceable from the beginning. 

For teams looking to carry commissioning insight into operational control, Cenosco’s IMS Suite offers targeted tools that help turn early findings into long-term integrity. 

Together, these tools help close the loop between project delivery and operational ownership by keeping risk visible, actioned, and compliant over time, once risks are captured within the system. 

References 

¹ HSE Buncefield Investigation Report: https://www.hse.gov.uk/comah/buncefield/ 
² MIIB Final Report: https://www.icheme.org/media/13708/buncefield-miib-final-report-volume-2b.pdf
³ BBC News – Buncefield Companies Fined: https://www.bbc.com/news/uk-england-10660356
⁴ UK Environment Agency: https://www.gov.uk/government/publications/the-buncefield-investigation-the-government-and-competent-authoritys-response-november-2008