Two Frameworks, One Goal, Very Different Scopes
OSHA's Process Safety Management standard (29 CFR 1910.119) and the Center for Chemical Process Safety's Risk Based Process Safety (RBPS) guidelines both aim to prevent catastrophic incidents at facilities handling highly hazardous chemicals. But they approach that goal differently — one as a legal mandate, one as a performance framework.
| Attribute | OSHA PSM 29 CFR 1910.119 |
CCPS RBPS Guidelines (2007) |
|---|---|---|
| Nature | Regulatory requirement — legally enforceable | Voluntary industry guideline — not enforceable |
| Issued by | OSHA (U.S. Dept. of Labor), 1992 | CCPS (AIChE Center for Chemical Process Safety), 2007 |
| Number of elements | 14 elements | 20 elements, 4 pillars |
| Applicability | Facilities with covered HHC above threshold quantities | Any facility seeking performance-based process safety |
| Approach | Prescriptive — defines what must be done | Risk-based — defines what good looks like at each level |
| Enforcement | OSHA inspections; penalties up to $156,259/violation | No enforcement — used for self-assessment and improvement |
| Maturity model | Binary: compliant or not | 4-level maturity model (Initiating → Proactive) |
| Coverage | U.S. facilities only | Global applicability |
| Relation to each other | Compliance with PSM ≠ compliance with RBPS | RBPS encompasses and extends PSM requirements |
The Key Insight
OSHA PSM compliance does not mean your process safety management is good — it means you've met the legal minimum. RBPS was designed to show what "good" actually looks like. A facility can be fully PSM-compliant and still have a weak process safety culture, poor metrics, and no management review process — all of which RBPS addresses but PSM does not require.
The 14 Elements of 29 CFR 1910.119
OSHA PSM was promulgated in 1992 following a series of catastrophic incidents — most notably the 1984 Bhopal disaster and the 1990 OSHA amendments. The standard requires 14 specific program elements for any facility handling covered highly hazardous chemicals above threshold quantities.
RBPS: 4 Pillars, 20 Elements
CCPS published the Risk Based Process Safety guidelines in 2007 to replace the older Process Safety Management Guidelines for Compliance. RBPS organizes process safety into four logical pillars — each representing a phase in the continuous improvement cycle — with 20 total elements.
Unlike PSM's flat list of requirements, RBPS provides a maturity model: each element is described at four levels (Initiating, Enabling, Proactive, and Enhanced), allowing facilities to benchmark their current state and plan improvement.
- Process Safety Culture RBPS Only
- Compliance with Standards RBPS Only
- Process Safety Competency RBPS Only
- Workforce Involvement ≈ PSM #1
- Stakeholder Outreach RBPS Only
- Process Knowledge Management ≈ PSM #2
- Hazard ID & Risk Analysis ≈ PSM #3
- Operating Procedures ≈ PSM #4
- Safe Work Practices ≈ PSM #9 + more
- Asset Integrity & Reliability ≈ PSM #8
- Contractor Management ≈ PSM #6
- Training & Performance Assurance ≈ PSM #5
- Management of Change ≈ PSM #10
- Operational Readiness ≈ PSM #7
- Conduct of Operations RBPS Only
- Emergency Management ≈ PSM #12
- Incident Investigation ≈ PSM #11
- Measurement & Metrics RBPS Only
- Auditing ≈ PSM #13
- Management Review & Continuous Improvement RBPS Only
Element-by-Element Mapping
The table below maps each OSHA PSM element to its RBPS counterpart. Not every PSM element maps cleanly — RBPS often combines multiple PSM concerns into a single broader element, or splits them into distinct components with additional scope.
Key Differences Between PSM and RBPS
1. Prescriptive vs. Performance-Based
PSM tells you what to do. RBPS tells you what good looks like and lets you decide how to get there. This is both RBPS's strength (flexibility, scalability, continuous improvement) and its limitation (harder to audit against, no legal enforcement mechanism).
2. The Maturity Model
RBPS's most important addition is a maturity scale for each element. The four levels are:
Where Does PSM Compliance Fall on This Scale?
A facility that meets all 14 PSM elements at the minimum required level typically falls between Level 1 and Level 2 on the RBPS maturity scale. Level 2 (Enabling) is roughly the OSHA compliance floor. Level 3 and 4 require active measurement, culture work, and systematic improvement — none of which PSM mandates.
2. Risk Tolerance and Prioritization
PSM has no concept of risk tolerance — you either comply or you don't. RBPS explicitly requires facilities to define their risk tolerance criteria (typically expressed as risk matrices or individual/societal risk metrics) and to use those criteria to prioritize hazard analysis recommendations. This risk-based prioritization is absent from PSM.
3. Organizational Elements
Three of RBPS's most powerful elements have no PSM equivalent: Process Safety Culture, Process Safety Competency, and Management Review & Continuous Improvement. These organizational elements address the systemic causes of most major incidents — leadership commitment, organizational learning, and the culture that determines whether rules get followed under pressure.
What RBPS Adds — Six Elements with No PSM Equivalent
Six of RBPS's 20 elements address areas that OSHA PSM either ignores entirely or treats only tangentially. These are the areas where facilities that meet PSM compliance but not RBPS expectations are most vulnerable to incidents.
Every major investigation of catastrophic process safety incidents — from Texas City to Deepwater Horizon — has identified cultural failures as root causes. PSM says nothing about culture. RBPS defines what a healthy process safety culture looks like: leadership commitment, worker empowerment to stop unsafe work, open reporting of concerns without fear of reprisal, and learning from near-misses. This is the element that separates high-performing facilities from compliant-but-vulnerable ones.
PSM assumes you'll comply with applicable codes and standards — but it doesn't require you to systematically identify which ones apply to your facility, track them, or verify compliance. RBPS requires a structured approach: identify applicable standards (NFPA, API, ASME, IEC, etc.), document compliance, and manage changes in standards over time.
PSM requires training — but it doesn't require the organization to assess whether it actually has the technical expertise needed to manage its hazards. RBPS adds organizational competency assessment: Does your HAZOP team include people who understand the chemistry? Does your Mechanical Integrity program have the right inspection expertise? Are process safety responsibilities clearly assigned to competent people?
This element addresses the discipline with which procedures are followed in day-to-day operations. PSM requires procedures to exist — but not that they be followed with rigor. RBPS defines conduct of operations as a distinct cultural expectation: shift handover discipline, control room standards, alarm response discipline, procedure adherence verification. Most incidents occur during normal operations, not during emergencies — this is why.
You cannot improve what you don't measure. PSM requires no process safety metrics — no lagging indicators (incident rates), no leading indicators (near-miss reports, overdue PHAs, open audit findings). RBPS defines a metrics system: process safety events (PSEA), near-miss rates, PHA recommendation close-out rates, overdue inspection percentages. This is how high-performing facilities identify degradation before it becomes a fatality.
PSM requires a compliance audit every three years — but it doesn't require management to actually review the performance of the PSM system, set improvement objectives, or drive change. RBPS adds a structured management review: senior leadership reviews PSM metrics, near-miss trends, audit findings, and resource adequacy at regular intervals. This is the governance mechanism that keeps a PSM program from degrading into a paperwork exercise.
Which Framework to Use — and When
- →Building or auditing a PSM compliance program for OSHA inspection readiness
- →Responding to an OSHA inspection or citation
- →Establishing the minimum required program elements for a new covered facility
- →Evaluating contractor or acquired facility compliance posture
- →You've met PSM compliance and want to benchmark the quality of your program
- →Building a multi-year process safety improvement roadmap
- →Assessing culture, competency, and organizational effectiveness
- →Operating facilities outside the U.S. where PSM doesn't apply but process hazards do
Best Practice: Use Both
The most effective approach is to use PSM as the compliance floor and RBPS as the performance target. Run PSM compliance audits every three years for regulatory readiness. Use RBPS self-assessments annually to identify where the program is strong and where it's degrading. Track RBPS maturity level trends over time as a measure of improvement.
Implementation Approach
For facilities that are PSM-compliant but want to move toward RBPS, the gap typically concentrates in the six RBPS-only elements and in the maturity level of existing elements. A practical approach: