Two Frameworks, One Goal, Very Different Scopes
OSHA's Process Safety Management standard (29 CFR 1910.119) and the Center for Chemical Process Safety's Risk Based Process Safety (RBPS) guidelines both aim to prevent catastrophic incidents at facilities handling highly hazardous chemicals. But they approach that goal differently — one as a legal mandate, one as a performance framework.
| Attribute | OSHA PSM 29 CFR 1910.119 |
CCPS RBPS Guidelines (2007) |
|---|---|---|
| Nature | Regulatory requirement — legally enforceable | Voluntary industry guideline — not enforceable |
| Issued by | OSHA (U.S. Dept. of Labor), 1992 | CCPS (AIChE Center for Chemical Process Safety), 2007 |
| Number of elements | 14 elements | 20 elements, 4 pillars |
| Applicability | Facilities with covered HHC above threshold quantities | Any facility seeking performance-based process safety |
| Approach | Prescriptive — defines what must be done | Risk-based — effort and rigor matched to risk |
| Enforcement | OSHA inspections; penalties up to $165,514/violation | No enforcement — used for self-assessment and improvement |
| Level of rigor | Same minimum requirements for every covered process | Scaled to risk, workload, and process safety culture |
| Coverage | U.S. facilities only | Global applicability |
| Relation to each other | Compliance with PSM ≠ compliance with RBPS | RBPS encompasses and extends PSM requirements |
The Key Insight
OSHA PSM compliance does not mean your process safety management is good — it means you've met the legal minimum. RBPS was designed to show what "good" actually looks like. A facility can be fully PSM-compliant and still have a weak process safety culture, poor metrics, and no management review process — all of which RBPS addresses but PSM does not require.
The 14 Elements of 29 CFR 1910.119
OSHA PSM was promulgated in 1992 following a series of catastrophic incidents, including the 1984 Bhopal disaster and the 1989 Phillips 66 explosion in Pasadena, Texas. Congress directed OSHA to issue it in the Clean Air Act Amendments of 1990. The standard requires 14 specific program elements for any facility handling covered highly hazardous chemicals above threshold quantities.
RBPS: 4 Pillars, 20 Elements
CCPS published Guidelines for Risk Based Process Safety in 2007, building on the process safety management framework CCPS first published in Guidelines for Technical Management of Chemical Process Safety (1989). RBPS organizes process safety into four logical pillars — each representing a phase in the continuous improvement cycle — with 20 total elements.
Unlike PSM's fixed list of requirements, RBPS asks each company to set the level of detail and rigor for each element based on three factors: its understanding of the risk, the demand for process safety work compared with available resources, and its process safety culture (CCPS RBPS overview).
- Process Safety Culture RBPS Only
- Compliance with Standards RBPS Only
- Process Safety Competency RBPS Only
- Workforce Involvement ≈ PSM #1
- Stakeholder Outreach RBPS Only
- Process Knowledge Management ≈ PSM #2
- Hazard ID & Risk Analysis ≈ PSM #3
- Operating Procedures ≈ PSM #4
- Safe Work Practices ≈ PSM #9 + more
- Asset Integrity & Reliability ≈ PSM #8
- Contractor Management ≈ PSM #6
- Training & Performance Assurance ≈ PSM #5
- Management of Change ≈ PSM #10
- Operational Readiness ≈ PSM #7
- Conduct of Operations RBPS Only
- Emergency Management ≈ PSM #12
- Incident Investigation ≈ PSM #11
- Measurement & Metrics RBPS Only
- Auditing ≈ PSM #13
- Management Review & Continuous Improvement RBPS Only
Element-by-Element Mapping
The table below maps each OSHA PSM element to its RBPS counterpart. Not every PSM element maps cleanly — RBPS often combines multiple PSM concerns into a single broader element, or splits them into distinct components with additional scope.
Key Differences Between PSM and RBPS
1. Prescriptive vs. Performance-Based
PSM tells you what to do. RBPS tells you what good looks like and lets you decide how to get there. This is both RBPS's strength (flexibility, scalability, continuous improvement) and its limitation (harder to audit against, no legal enforcement mechanism).
2. Rigor Scaled to Risk
RBPS's central idea is that process safety effort should match the need. CCPS describes a spectrum of strategies that companies move along — standards-based ("What should I do?"), compliance-based ("What do I have to do?"), continuous improvement ("How can I improve based on my experience?"), and risk-based ("How can I better manage risk?") — and says the right level of detail and rigor for each practice depends on three factors:
- Risk understanding — how well the company understands what can go wrong, how bad it could be, and how often it might happen.
- Demand versus resources — for example, how many change requests must be reviewed each month compared with the people available to review them.
- Process safety culture — the culture in which the practices will be carried out.
Where Does PSM Compliance Fit?
PSM is a compliance-based strategy: it sets the same minimum requirements for every covered process. RBPS treats that as a starting point and asks where higher risk, heavier workload, or a weaker culture justify going further. Source: CCPS, Risk Based Process Safety overview.
3. Risk Tolerance and Prioritization
PSM has no concept of risk tolerance — you either comply or you don't. RBPS explicitly requires facilities to define their risk tolerance criteria (typically expressed as risk matrices or individual/societal risk metrics) and to use those criteria to prioritize hazard analysis recommendations. This risk-based prioritization is absent from PSM.
4. Organizational Elements
Three of RBPS's most powerful elements have no PSM equivalent: Process Safety Culture, Process Safety Competency, and Management Review & Continuous Improvement. These organizational elements address the systemic causes of most major incidents — leadership commitment, organizational learning, and the culture that determines whether rules get followed under pressure.
What RBPS Adds — Six Elements with No PSM Equivalent
Six of RBPS's 20 elements address areas that OSHA PSM either ignores entirely or treats only tangentially. These are the areas where facilities that meet PSM compliance but not RBPS expectations are most vulnerable to incidents.
Every major investigation of catastrophic process safety incidents — from Texas City to Deepwater Horizon — has identified cultural failures as root causes. PSM says nothing about culture. RBPS defines what a healthy process safety culture looks like: leadership commitment, worker empowerment to stop unsafe work, open reporting of concerns without fear of reprisal, and learning from near-misses. This is the element that separates high-performing facilities from compliant-but-vulnerable ones.
PSM assumes you'll comply with applicable codes and standards — but it doesn't require you to systematically identify which ones apply to your facility, track them, or verify compliance. RBPS requires a structured approach: identify applicable standards (NFPA, API, ASME, IEC, etc.), document compliance, and manage changes in standards over time.
PSM requires training — but it doesn't require the organization to assess whether it actually has the technical expertise needed to manage its hazards. RBPS adds organizational competency assessment: Does your HAZOP team include people who understand the chemistry? Does your Mechanical Integrity program have the right inspection expertise? Are process safety responsibilities clearly assigned to competent people?
This element addresses the discipline with which procedures are followed in day-to-day operations. PSM requires procedures to exist — but not that they be followed with rigor. RBPS defines conduct of operations as a distinct cultural expectation: shift handover discipline, control room standards, alarm response discipline, procedure adherence verification. Most incidents occur during normal operations, not during emergencies — this is why.
You cannot improve what you don't measure. PSM requires no process safety metrics — no lagging indicators (incident rates), no leading indicators (near-miss reports, overdue PHAs, open audit findings). RBPS defines a metrics system: process safety events (PSEA), near-miss rates, PHA recommendation close-out rates, overdue inspection percentages. This is how high-performing facilities identify degradation before it becomes a fatality.
PSM requires a compliance audit every three years — but it doesn't require management to actually review the performance of the PSM system, set improvement objectives, or drive change. RBPS adds a structured management review: senior leadership reviews PSM metrics, near-miss trends, audit findings, and resource adequacy at regular intervals. This is the governance mechanism that keeps a PSM program from degrading into a paperwork exercise.
Which Framework to Use — and When
- →Building or auditing a PSM compliance program for OSHA inspection readiness
- →Responding to an OSHA inspection or citation
- →Establishing the minimum required program elements for a new covered facility
- →Evaluating contractor or acquired facility compliance posture
- →You've met PSM compliance and want to benchmark the quality of your program
- →Building a multi-year process safety improvement roadmap
- →Assessing culture, competency, and organizational effectiveness
- →Operating facilities outside the U.S. where PSM doesn't apply but process hazards do
Best Practice: Use Both
The most effective approach is to use PSM as the compliance floor and RBPS as the performance target. Run PSM compliance audits every three years for regulatory readiness. Use RBPS self-assessments annually to identify where the program is strong and where it's degrading. Track process safety metrics (such as the CCPS leading and lagging indicators) over time as a measure of improvement.
Implementation Approach
For facilities that are PSM-compliant but want to move toward RBPS, the gap typically concentrates in the six RBPS-only elements and in the rigor of existing elements. A practical approach: