ALARP demonstration is the point where risk assessment stops being theoretical and becomes legally defensible. Regulators at the UK HSE, ADNOC, and equivalent authorities do not accept a tolerable risk finding as the end of the story; they require evidence that every reasonably practicable risk reduction measure has been evaluated, applied, or consciously rejected. That obligation sits with the duty holder. Most safety case deficiencies reviewed in the Middle East and Southeast Asia trace back not to missing hazard studies but to ALARP arguments that lack quantified, traceable evidence linking identified risk reduction measures to a documented decision.
This article breaks down what ALARP demonstration requires at each stage, which risk tolerability criteria apply, how QRA and LOPA supply the quantified evidence base, and how to structure the final argument in a format regulators and clients will accept without requiring rework.
What ALARP Demonstration Actually Requires
ALARP demonstration requires a duty holder to prove not assert that identified risk reduction measures have been evaluated against their benefit, and that any measure not implemented would cost grossly more than the safety benefit it delivers. The UK HSE’s Tolerability of Risk framework, published in 2001 and referenced by ADNOC and KOC safety case requirements, defines three regions: broadly acceptable (below 10⁻⁶ per annum individual risk), the ALARP region (between 10⁻⁶ and 10⁻⁴), and the intolerable zone above 10⁻⁴. A risk sitting inside the ALARP region is tolerable but tolerability does not satisfy ALARP. The duty holder must still demonstrate that no further reasonably practicable risk reduction measures remain unimplemented.
What this means in practice: ALARP demonstration is a burden-of-proof exercise, not a compliance checkbox. The onus falls entirely on the duty holder to prove that residual risk is ALARP; the regulator is not required to prove it isn’t.
Facilities that treat “tolerable risk” and “ALARP satisfied” as synonymous regularly receive regulatory challenge notices at permitting stage. The two conditions are distinct. Risk being within the ALARP region establishes that it is not intolerable. ALARP demonstration establishes that it has been reduced as far as reasonably practicable. Both must be satisfied independently.
A well-structured Process Hazard Analysis (PHA) study establishes the hazard inventory that feeds the ALARP demonstration without a thorough hazard identification stage; risk reduction measure selection has no structured basis.
Risk Tolerability Criteria: Defining the ALARP Region
Risk tolerability criteria for ALARP demonstration are established by the HSE UK Tolerability of Risk framework, which specifies Individual Risk Per Annum (IRPA) limits and societal risk thresholds that define where the ALARP obligation is triggered. Individual risk is expressed as the probability of fatality per annum for the most exposed individual at or near the facility boundary. Societal risk is expressed through F-N curves frequency versus number of fatalities and must remain below the ALARP boundary line defined in the applicable regulatory guidance.
The following criteria apply across most major hazard jurisdictions:
| Risk Category | ALARP Demonstration Criterion | Individual Risk Per Annum (IRPA) Threshold | Regulatory Basis |
| Broadly Acceptable | No ALARP argument required | Below 1×10⁻⁶/year | HSE UK TOR Framework |
| ALARP Region Workers | ALARP demonstration required | 1×10⁻⁶ to 1×10⁻³/year | HSE UK / ADNOC SP-1170 |
| ALARP Region Public | ALARP demonstration required | 1×10⁻⁶ to 1×10⁻⁴/year | HSE UK / International Norm |
| Intolerable | Risk must be reduced regardless of cost | Above 1×10⁻³ (workers) / 10⁻⁴ (public) | HSE UK TOR Framework |
The F-N curve criterion adds a societal dimension that individual IRPA alone cannot capture. A scenario with a low individual risk but high potential for multi-fatality events, a vapour cloud explosion in a congested offshore module, for example can satisfy IRPA limits while still sitting above the F-N curve ALARP boundary. Both criteria must be checked independently within the ALARP demonstration.
That said, there is a compounding factor that many practitioners miss: risk tolerability criteria vary by jurisdiction. ADNOC’s SP-1170 applies modified IRPA thresholds for workers on operated assets. KOC applies HSE UK criteria directly. Projects spanning multiple regulatory jurisdictions must document which criteria set governs each facility boundary: a single set of QRA outputs mapped against multiple criteria tables.
Recognized for excellence.
PROJECTS DELIVERED ACROSS THE GLOBE
QRA and LOPA as Quantified ALARP Evidence
QRA (Quantitative Risk Assessment) provides the numerical evidence base for ALARP demonstration by calculating individual risk contours, F-N curves, and risk contribution breakdowns across all identified major accident hazards. A QRA-based ALARP demonstration identifies which risk reduction measures produce the greatest risk reduction per unit of cost, a prerequisite for defending the gross disproportion test. Without QRA, ALARP demonstration rests on qualitative engineering judgment alone, which regulators in the Middle East and UK increasingly reject for major hazard facilities above defined thresholds.
The Gross Disproportion Test in ALARP Demonstration
The gross disproportion test is the mechanism by which a duty holder justifies not implementing a technically feasible risk reduction measure. It is not a simple cost–benefit ratio. HSE UK guidance specifies that the greater the risk, the less weight cost and inconvenience carries in the disproportion argument. For risks in the upper ALARP region (IRPA approaching 10⁻⁴), a measure must cost many times its calculated safety benefit before the gross disproportion test can be passed. The asymmetry is intentional: the test is designed to prevent cost from defeating safety at high-risk levels.
In practice, a gross disproportion factor of 3× to 10× is typically applied in the lower ALARP region. At the upper boundary, factors of 10× or higher are required before a measure can be set aside. These multipliers must be documented explicitly in the ALARP demonstration stating “cost is disproportionate” without a supporting calculation is insufficient and will be challenged.
LOPA as a Risk Reduction Verification Tool
Layer of Protection Analysis (LOPA) complements QRA by verifying that independent protection layers (IPLs) instrumented safety functions, passive barriers, and procedural controls collectively reduce scenario frequency to ALARP demonstration targets. IEC 61511 governs the performance requirements for Safety Instrumented Systems (SIS) used as IPLs, specifying that each claimed SIS layer must have a probability of failure on demand (PFD) traceable to certified failure rate data. A LOPA-verified ALARP demonstration specifies the initiating event frequency, each IPL’s claimed PFD, and the resulting mitigated event frequency all of which feed directly into QRA consequence modelling.
A HAZOP study is the upstream source of the deviation scenarios and safeguard inventory that LOPA requires. Without a completed HAZOP, LOPA has no structured scenario list and the ALARP demonstration has no verifiable hazard basis.
Post-2020 regulatory submissions reviewed across ADNOC and HSE-regulated projects confirm a clear pattern: ALARP demonstration cases backed by LOPA-verified IPL chains with IEC 61511-traceable PFD values clear first-stage review at a significantly higher rate than those relying on qualitative HAZOP action-item lists alone. Purely narrative ALARP arguments are being returned for quantification at the permitting stage.
Our process safety management services cover QRA, LOPA, and safety case development across upstream, midstream, and downstream facilities in the Middle East and Southeast Asia.
Structuring the ALARP Argument for Regulators and Clients
Structuring the ALARP demonstration as a formal argument not just an appendix to a QRA report is what separates submittals that clear regulatory review from those that generate action item lists. The argument structure must be traceable: every risk reduction measure considered must appear in the record with a disposition (implemented, rejected with gross disproportion justification, or deferred with schedule commitment). Regulators require the argument to be readable as a standalone document, not reconstructed from cross-references across five separate study reports.
A compliant ALARP demonstration argument is structured in the following sequence:
- Define the hazard scope list all major accident hazard (MAH) scenarios from the HAZOP/HAZID register, categorised by consequence type (fire, explosion, toxic release, structural failure)
- Establish baseline risk document QRA-derived individual risk contours and F-N curve position against applicable tolerability criteria before any additional risk reduction measures
- Generate the risk reduction measure register list all technically feasible measures identified through HAZOP, HAZID, inherent safety review, and engineering judgment, with preliminary cost estimates
- Apply the gross disproportion test document the safety benefit calculation (risk reduction × value of preventing a fatality, typically £1–2M per the UK HSE’s VPF guidance) against implementation cost for each rejected measure
- Verify residual risk via LOPA confirm that accepted IPLs reduce mitigated scenario frequency to the ALARP demonstration target frequency
- Document the ALARP statement a signed, dated engineering statement confirming that residual risk is ALARP, referencing the QRA report, LOPA worksheets, and risk reduction measure register by document number
The downstream consequence of skipping step 4 is a regulatory objection that requires the entire measure register to be reworked adding 4 – 8 weeks to the permitting timeline at the point of maximum schedule pressure.
Bow-Tie Analysis is an effective visualisation tool at step 6: it maps prevention and mitigation barriers against each MAH scenario in a format that both regulators and client project sponsors can review without requiring QRA software access.
Key Takeaways
ALARP demonstration is a structured, evidence-based legal obligation not a narrative summary attached to a QRA report. Regulators require a traceable argument that distinguishes tolerable risk from ALARP-satisfied risk, applies the gross disproportion test with documented cost-benefit calculations, and verifies residual risk through LOPA-confirmed IPL chains with IEC 61511-traceable PFD values.
The facilities that clear regulatory review on first submission are those whose ALARP demonstration package treats the argument as a standalone deliverable. Every risk reduction measure is in the record. Every rejected measure has a gross disproportion calculation behind it. Every IPL has a verified PFD. That discipline applied consistently across the hazard register is what converts a QRA output into a defensible ALARP demonstration.
For projects in the Middle East and Southeast Asia requiring QRA, LOPA, or complete safety case development, iFluids Engineering’s process safety team delivers end-to-end ALARP demonstration packages for upstream, midstream, and downstream facilities. Contact us to discuss your project scope.
Frequently Asked Questions
ALARP stands for As Low As Reasonably Practicable. The UK HSE’s Tolerability of Risk framework defines it as the obligation to reduce risk to a level where further reduction would require effort, cost, or inconvenience grossly disproportionate to the safety benefit achieved. ALARP applies to risks within the tolerable region between 10⁻⁶ and 10⁻⁴ individual risk per annum for the public. It does not mean risk has been eliminated; it means all reasonably practicable measures have been implemented.
ALARP demonstration to a regulator requires three documented steps: quantifying residual risk using QRA against HSE UK or applicable tolerability criteria; generating a complete risk reduction measure register from HAZOP, HAZID, and inherent safety review; and applying the gross disproportion test to each measure not implemented, with a documented cost-benefit calculation. The completed ALARP demonstration must be submitted as a traceable standalone argument, not embedded in the QRA appendix.
The gross disproportion test determines whether the cost of implementing a risk reduction measure is grossly disproportionate to the safety benefit it delivers. HSE UK guidance specifies that for risks in the upper ALARP region, a measure must cost 10× or more its calculated safety benefit before it can be legitimately set aside. The test places the burden of proof on the duty holder not the regulator to justify non-implementation.
The ALARP region is defined by Individual Risk Per Annum (IRPA) thresholds and societal risk F-N curve limits. For members of the public, the tolerable upper limit is 10⁻⁴/year and the broadly acceptable lower limit is 10⁻⁶/year. For workers, the upper tolerable limit is 10⁻³/year. Any risk within these bands is in the ALARP region and requires ALARP demonstration; it cannot be accepted without documented evidence of risk reduction measure evaluation.
Tolerable risk means a risk falls within the ALARP region below the intolerable ceiling and is acceptable in principle. ALARP satisfied means the duty holder has demonstrated that all reasonably practicable risk reduction measures have been implemented or justifiably rejected. A risk can be tolerable but ALARP is not satisfied. Both conditions must be confirmed independently before a safety case can be accepted by a regulator or major operator client.
The primary tools for ALARP demonstration are QRA for individual and societal risk quantification, LOPA for IPL-level risk reduction verification, HAZOP and HAZID for risk reduction measure identification, and cost-benefit analysis for the gross disproportion test. Bow-Tie Analysis provides barrier visualisation for the final ALARP argument document. IEC 61511 governs PFD claims for SIS-based IPLs within the LOPA layer.
Qualitative ALARP demonstration is accepted for lower-consequence, lower-complexity facilities where risk falls well within the ALARP region. However, for major hazard facilities offshore platforms, refineries, gas processing plants regulators including ADNOC, KOC, and HSE UK require QRA-backed ALARP demonstration with individual risk contours and F-N curves. Qualitative-only ALARP cases submitted for major hazard facilities are routinely returned for quantification at first review.