Brookhaven Science Associates U.S. Department of Energy

1. Sharing for Performance Excellence ASQ Energy & Environmental Conference Identifying & Managing Risks September 20, 2005 Brookhaven Science AssociatesU.S. Department of Energy Roy H. Lebel

2. Presentation Outline • A little about Brookhaven National Laboratory • A new contract requirement • The hammer that made it happen • The assurance model • BNL Level (the Laboratory) • Risk identification and barrier process mapping • BSA Level (the Corporate Board) • Monitoring and Reporting • What does it take? • Discussion • Successes/failures and future challenges

3. Where is Brookhaven National Lab? Long Island –NY USA

4. Where is Brookhaven National Lab? Long Island NY

5. Brookhaven National Laboratory- NY-USA Corporate Park Structure

6. Brookhaven National Laboratory Designing, building,and operating it safely and successfullyrequires arisk management approach that is reasonable and manageable. “What keeps me up at night!!!”

7. Brookhaven National Laboratory Is a government owned, contractor operated facilitymanaged under contract to the U.S. Department of Energy since 1998 by Brookhaven Science Associates, LLC,a partnership between Stony Brook University and Battelle Memorial Institute. DOE required BSA to demonstrate a “culture change”in Laboratory management, maintaining excellent sciencewhile improving environmental, safety, health and quality management throughout the Laboratory. BSA has implemented approximately 34 managementsystems based on industry best practices.

8. A New 2005 Contract Requirement The Process BSA Contract Section C.3.3 Performance Objectives & Measures “The Contractor shall develop and implement a Laboratory assurance process, acceptable to the Contracting Officer, which provides reasonable assurance that the objectives of the Contractor’smanagement systems are being accomplished and that the systems and controls will be effective and efficient. The Contractor’s assurance process shall reflect an understanding of the risks, maintain mechanisms for eliminating or mitigating the risks, and maintain a process to ensure that the management systems and their attendant assurance process(es) meet contract requirements.”

9. New Contract Requirement The Deliverable BSA Contract Clause I-76 Management Controls - Section (c) “On an annual basis, the Contractor, through an officer at a level above the President of BSA, shall submit an assurance to the Contracting Officer that the system of management controls, including all systems revised in accordance with the clause of this Contract entitled, “Application of DOE Contractor Requirements Documents”, is adequate to assure that the objectives of the management system are being accomplished and that the system and controls are effective and efficient.”

10. BSA Assurance Model • Receives assurance from risk committees • Provides assurance letter to DOE • Adjusts vision, strategy, expectations, limits based on DOE feedback on assurance letter BSA Board Performance Data and analysis, Opportunities, Risk Vision, Strategy, Expectations, Limits BSA Risk Committees • Review Quarterly Performance Report • Assess key processes; verify Lab-provided data • Commission independent reviews • Provides “assurance” to the BSA Board Chairman Audit and Finance Institutional Strategy BSA Operations Personnel and Compensation • Initiates management actions based on Quarterly Performance Report • Consistent with strategy, risk limits • Provides report to BSA risk committees BNL Policy Council • Provides Quarterly Performance Report to Policy Council • Management system assessments, line assessments • Measures, trends, issues, causes, recommendations • External reviews Management System Steward’s Forum Work planned and performed, Data collected: self assessments, audits, oversight, peer review Line Managers and Staff

11. BSA Assurance Model:The BNL Level • Initiates management actions based on Quarterly Performance Report input • Consistent with strategy, Risk limits • Provides performance data to BSA Policy Council • Provide Quarterly Performance Report to Policy Council • High risk event definition; barrier process development • Management system assessments, line assessments • Measures, trends, issues, causes, recommendations • External reviews Management System Stewards • Work planned and performed, • Data collected: self assessments, audits, oversight, peer review Line Managers and Staff

12. BNL Level:Management Systems-Based Approach • BNL’s primary functions and processes captured in 34 Management Systems (MS). • Each BNL MS has an assigned “Steward” - typically a Level 1 manager or above. • Each Steward has identified a number of high risk events. • Each Steward has also identified functions and processes within their MS that serve as “barriers” to these events. • These “barrier processes” are given high priority in performance measurement, self-assessment and external assessments. • The BSA assurance process will focus on these “barrier processes” within BNL’s management systems by focusing on MS performance.

13. BNL Level:Barrier Process Mapping High Risk Events BNL Management Systems RISK MANAGEMENT Barrier Processes Barrier Processes

14. Risk Barrier Analysis

16. BNL Level:Example of High Risk Event and Barrier Processes High Risk Event: Fire causes extended outage of user facility

17. BNL Level:Ongoing Focus on Management Systems BNL Management Systems ASSURANCE BarrierProcess BarrierProcess BarrierProcess Performance Measurement Integrated Assessment BarrierProcess BarrierProcess

18. BNL Level:Management Systems-Based Approach • MS Stewards continually monitor the effectiveness of “barrier processes” within their MS • MS Stewards meet quarterly • Emerging and new requirements • Performance trends and issues • Develop quarterly report input • Quarterly Performance Report to BNL Policy Council • Integrates performance and assessment information • Quarterly Performance Reports are a key element in the Assurance Process.

19. BNL Level:Quarterly Performance Monitoring (Internal) Presentation to BNL Policy Council • Organized by Management System • Contents include: • Contract Critical Outcome Performance status • Management System Performance • Steward’s dashboard assessment of MS performance • Major events and occurrences • DOE feedback • Significant assessments/reviews/audits and summary results • Brief narrative description of issues and management response • Institutional Performance

20. Brookhaven National Laboratory Fiscal Year 2005 Brookhaven Science Associates Third Quarter Performance Summary Presentation to Policy Council July 25, 2005 BHSO August 2, 2005

21. BHSO Mgmt. System Stewards and Point of Contacts Program Contractual Performance Measures Agenda • Measure Owners • Summary of Performance Measure • Status of Metric • Influencing Factors • Plans • Partnership Items 1- • Assigns POCs for each management system • Roles and responsibilities for stewards and POCs • Mechanisms of providing feedback 2- • Current Condition • Plans & Status 3- Management System Performance • Event Data Analysis • ORPS • PAAA • Assessment/Corrective Action Tracking • Tier 1 Inspection Results 4- Institutional Performance

22. FY 2005 Quarter 3 - 3.0 Laboratory Management and Operations Structure Outstanding / Excellent Good Marginal / Unsatisfactory LAOBORATORYMGMT. ANDOPERATIONS 3.0 MANAGEMENT SYSTEM SITE INFRASTRUCTURE, COMMUNICATIONS CORPORATE BUSINESS IMPROVED ESH&Q - PLANNING, ASSESSMENT FACILITIES , OPERATIONS LEADERSHIP PROCESSES OPERATIONSSERVICES AND TRUST ANDIMPROVEMENT AND SECURITY 3.2 3.4 3.1 3.3 3.5 3.6 COMMUNITY EDUCATION, GOVERNMENT ALTERNATIVE STRATEGIC MANAGEMENT SYSTEM PHASE IV OF OSHA REPORTABLEINJURY FINANCING (AF) BENCHMARKINGSTUDY PARTNERSHIPS MANAGEMENT MATURITY DETERMINATIONS & PUBLIC AFFAIRS MGMT. 3.5.1 3.1.1 3.2.1 3.4.1 3.3.1 3.6.1 LABORATORY THIRD PARTYASSESSMENT PROMOTING SCIENTIFIC CYBERSECURITY BNL HOUSING DAYS AWAY, RESTRICTED, LEADERSHIIP INITIATIVES, ACCOMP. OF PROGRAM RECONST. PROJECT (HRP) OR TRANSFERRED RATE & OPS. PRIORITIES 3.5.1.1 3.1.2 3.2.2 3.3.2 3.4.1.1 3.6.1.1 PROJECT PROCUREMENT OPERATIONS EXPANDING PARTNERSHIP TOTAL REPORTABLE DIVERSITY MANAGEMENT CASE RATE 3.5.2 3.4.1.2 OPPORTUNITIES 3.1.3 3.2.3 3.6.1.2 MAINTENANCE INTERNAL COMMUNICATIONS INVESTMENT INDEX (MII) 3.5.3 AND INVOLVEMENT 3.6.1.3 ENERGY CONTRACT 3.5.4 INFRASTRUCTURE RELIABILITY 3.5.5

23. MEASURE 3.1.3 Diversity • Summary of Performance Measure • BSA will strive for Best Practices in managing diversity programs linked to recruitment and diversity educational awareness activities. • Specific Status of Metric • Suggested changes to draft Diversity (DV) Engagement Practices checklist were completed. Checklist will be reviewed by Level I Managers at Policy Council this quarter. (Measure #1) • Timeline has been established for completion of recommendations outlined in 2001 Hewitt Diversity Emphasis Study. Specifically, define and communicate role for DV and its involvement in HR processes by September 2005 and develop tool to address diversity management accountability of Lab Managers and link to performance appraisal process by July 2005. (Measure # 2) • Phase II of Diversity Educational Awareness Training pilot program for BES employees is under way. Training for Religious Awareness occurred on May 25, 2005. Three remaining diversity education awareness topics will be presented on July 20, September 21 and October 19, 2005. (Measure #5) • BHSO Partnership Items • The schedule of the BSA’s HR management system steward, Bill Hempfling, and BHSO’s HR contact, Bob Gordon, would not permit solicitation of feedback in time for submission of this summary. Diversity Manager, Shirley Kendall, confirmed the Outstanding projection for the contract performance measure on Diversity with BHSO’s performance measure owner, Pat Palladino. • Objectives for Next Quarter • Draft Section II of Diversity Engagement Practices profile and seek review by Diversity Management Steering Committee. (Measure #1) • Meet with Affinity Group leaders to seek feedback on Diversity Services. (Measure #5) • Brief at least two departments on the status of Diversity at monthly staff meeting. (Measure #2) • Issues • None Performance Metric

24. Management System Performance Dashboard Conditions • GREEN = MS is complete: • Processes and procedures are adequately defined and implemented to protect the institution from significant risk • Major milestones/planned improvements are achievable with current resources • No impending requirements or conditions will represent significant institutional vulnerabilities • Performance measure and/or assessments results indicate a well functioning, compliant system, with only minor improvements needed • YELLOW = MS is somewhere between Red and Green: • Definition and/or implementation of processes and procedures is less than adequate which may result in damage the laboratory’s reputation, fines or significant loss in fee, or other recognized risk • Major milestones/planned improvements have been/or will be missed however can be completed with current resources • Impending requirements or conditions may result in significant institutional vulnerabilities • Performance measure and/or assessments results indicate a need for specific improvements • RED = MS is incomplete: • Definition and/or implementation of processes and procedures are inadequate and will likely result in damage the laboratory’s reputation, fines or significant loss in fee, or other recognized risk • Major milestones/planned improvements have been/or will be missed and can not be completed with current resources • Impending requirements or conditions will result in significant institutional vulnerabilities • Performance measure and/or assessments results indicate systematic weaknesses and requires immediate management attention

25. FY05 Management System Performance • Staffing levels insufficient M. Bebon Deputy Director for Operations • Assessment results indicate need for improvement A. McNerney ALD for Facilities & Operations • DOE order 1.5.1 not fully satisfied • Improvement/Milestones planned

26. Institutional Performance • ORPS • PAAA • Assessment/Corrective Action Tracking • Tier 1 Inspection Results Requirement Office of Science Quarterly ORPS DOE-EH BHSO QUARTERLY Executive View Quarterly PAAA BHSO ATS BHSO Tier 1 ESH Coord

27. BNL Level:Quarterly Performance Monitoring (External) Report to the BSA Risk committees • Organized by High Risk Events • Contents include: • Risk Metrics • Management System Performance • Steward’s dashboard assessment of MS performance • Major events and occurrences • DOE feedback • Significant assessments/reviews/audits and summary results • Brief narrative description of issues and management response • Institutional Performance

28. Brookhaven National Laboratory Brookhaven Science Associates Third Quarter Operations Risk Committee Risk Package

29. BSA Structure for Assurance:New Proposed Risk Committee 1.0 Executive Overview The Brookhaven Science Associates (BSA) Operations Risk Committee has identified a series of potential high-risk operational events that could occur at the Laboratory. These high- risk events were then analyzed to determine key Brookhaven National Laboratory (BNL) processes that are in place to prevent them from occurring or to mitigate the associated impacts. The level of effectiveness of these key “barrier processes” is a direct measure of the degree of operational risk being accepted by the BSA Board, Laboratory management, and the Department of Energy (DOE). This report provides the status of a series of metrics that have been selected by the Operations Risk Committee of the BSA Board as the optimum indicators of the effectiveness of BNL’s “barrier processes” or as related indicators of overall performance in a given area. • Currently 20 metrics are being monitored in the area of operations. These metrics fall under five principal categories and include a mix of leading and lagging indicators. The categories and their associated metrics are as follows: • Worker Safety and Health (High Risk Event: Serious injury, occupational illness, or fatality of a worker, guest, or member of the public) §TRC and DART Rates §Training Accomplishment §Environment, Safety, Health and Quality Tier I Inspection Program Effectiveness §Construction Site Safety non-conformances per inspection §Unplanned worker radiation exposures §PAAA trend analysis • Environmental Stewardship (High Risk Event: Major environmental release, or significant regulatory action) §Number of environmental permit limit exceedances §Number of unplanned releases §Number of environmental enforcement actions §Failure to sustain ISO 14001 certification • Protection of National Security and Government Property (High Risk Event: Loss, theft or compromise of nuclear or classified materials; loss of theft of government property) • ·Security alarm system performance • ·Security forces response time • ·Number of security incident reports involving nuclear, classified or property loss and number of nuclear material balance reports indicating discrepancies

30. 2.1.2 Training Accomplishment Commentary • Required training accomplishment continues to meet expectations at greater than 95% for employees. Continued effort is needed to improve the results for transient guests and contractors. Reviews/Audits • Energized Electrical Work assessment found training program functional and compliant with NFPA and recommended minor, specific revisions to electrical courses. • Contractor Vendor Orientation was audited by Liberty Mutual in anticipation of the increased construction activities and found it effective, complete, and compliant. • Cyber Security Review and EMS/OHSAS Registration audit found no training issues. Data Point on the Graph Represents • The percent of required training completed, by quarter, is shown on the graph for employees and contractors. Limit Discussion • The required training goal is 95%. There is an expectation of 100% compliance for training and qualifications to perform work. This Graph Produced From • Input from the Human Resources & Occupational Medicine Why Monitor the Risk? • The purpose of the Training and Qualifications program is to ensure that BNL employees, guests, users, and contractors are trained and qualified to perform their assigned tasks and job functions. Training requirements are established in accordance with regulatory requirements for work to be performed, hazards that may be encountered, areas that will be accessed, potential for risk, and general site requirements. BNL has defined minimum training requirements for work to be performed, and monitors the completion of these requirements. In addition to ensuring that personnel receive appropriate training, the BNL is committed to ensuring that its workers are qualified to perform their jobs. •  This metric is a leading indicator for management to review and to take action on, however, it should not be construed that personnel are working without required training. There is an expectation of 100% compliance for training and qualifications to perform work. Data Point on the Graph Represents The percent of required training completed, by quarter, is shown on the graph for employees and contractors. Limit Discussion The required training goal is 95%. There is an expectation of 100% compliance for training and qualifications to perform work. This Graph Produced From Input from the Human Resources & Occupational Medicine Division. Contact Point for More Information B. Schwaner (631) 344-3244

31. Management System Assessment Steward Assessment: Cyber Security Corrective Action Plans - Yellow HSPD-12/PIV - Yellow Asset Management - Yellow Contract Measures Measure 3.2.2 Cyber Security: Risk Measures Performance measures are being developed as corrective actions to to address the findings of the DOE-OA Unclassified Cyber Security Program Assessment (11/04) findings. Assessment Status/Results Weekly project plan meetings show that the FY05 corrective action (milestones and end dates) outlined in the corrective action plan are on schedule. An oversight committee was established to monitor the status of the implementation of the corrective actions. Accomplishments As of June 30, 2005, the unclassified cyber security program has completed 4 of the 19 action items for FY05. The classified program has completed 12 of 13 action items for FY05. A request was submitted to BHSO to conduct an independent verification and validation of actions completed by June 23, 2005. BHSO Partnership Items BHSO agrees that the Management System Assessment remain rated as Yellow. At the request of BHSO the Chicago Service Center Safeguards and Security Cyber Expert performed an assessment of the entire BNL Corrective Action Plan status (including actions for BNL, BHSO and SC). This assessment found that as of June 10, 2005 there were 17 action items closed, three findings that were closed (BNL-CS-011, BNL CS-012 and CH-CS-002) and one item that is overdue and has been assigned a revised completion date. There were four items that could be closed, except for the formal approval of revised policies and procedures. All other items are on schedule for completion. Objectives for Next Quarter Complete the remaining 15 corrective actions for the unclassified cyber security program, and the single remaining corrective action for the classified cyber security program. Issues Even though implementation of minimum baseline security configurations on BNL computers is a FY06 corrective action milestone, it might impact the FY05 C&A corrective action. By not implementing these configurations there is a risk that a control process may not be identified and BNL will be unable to inform DAA of this risk. BNL and BHSO still have not reached agreement regarding which findings constitute “Significant Weakness”. Operations Risk Committee Information Resource Management System Marginal Yellow

32. BSA Assurance Model:The BSA Level • Receives assurance from risk committees • Provides assurance letter to DOE • Adjusts vision, expectations, limits based on DOE feedback on assurance letter BSA Board Vision Expectations, Limits Performance Data and analysis, Opportunities, Risk BSA Committees • Review BNL Quarterly Performance Report • Assess key processes; verify Lab-provided data • Commission independent reviews • Provide “assurance” to the BSA Board Chairman BNL Policy Council

33. BSA Structure for Assurance:Proposed Risk Committees BSA Board Operations Audit & Finance (combined) Personnel & Compensation Institutional Strategy (new) Business Development Committee assurance responsibilities to be distributed

34. BSA Level:Risk Committee Functional Responsibilities • Operations Committee- has responsibility to assure that management and operations are conducted in a manner that will ensure the safety and security of the staff, the public, and the environment and adequately protect DOE assets from theft and/or damage. • Audit and Finance Committee - has responsibility to ensure that the allocation and utilization of funds meet the expectations of sponsors, staff, and stakeholders and is in accordance with all applicable contractual and regulatory requirements.

35. BSA Level:Risk Committee Functional Responsibilities • Personnel and Compensation Committee - has responsibility to ensure the effectiveness of the Laboratory’s processes to attract and retain the highest caliber workers and to ensure a workforce that reflects and values diversity. • Institutional Strategy Committee - has responsibility to assure that the Lab’s strategy for the growth and vitality of its scientific mission is supportive of DOE’s missions and other stakeholder needs and expectations, and is being communicated and executed in a manner that will achieve the desired objectives.

36. BSA Level:Risk Committee Responsibilities • Maintain awareness of Lab performance and issues throughout the FY • Typically focus at Management System level • Interact primarily with Stewards • Conduct independent assessments and verifications as deemed appropriate • Report findings to the BSA Board • Recommend “Assurance” to the BSA Board

37. BSA Level:Risk Committee Data Resources • Laboratory-provided • Quarterly performance and assessment data • Quarterly risk packages • Performance on key performance measures including DOE Critical Outcomes • Summary of integrated assessment program results • Narrative discussion of issues and plans • Presentations and reports to the Board • Independence is KEY • BSA Corporate Oversight reviews • External assessments of BNL • Other existing forums (e.g. Battelle Operations Council) • Committee staff on-site assessment/verification reviews

38. BSA Level:High Risk Event/Risk Committee Alignment Operations • Fatality or serious injury to employee, guest, contractor or member of the public • Loss or theft of classified matter or nuclear material • Successful terrorist attack • Catastrophic loss/damage to facilities(fire, flood, explosion, collapse) • Major chemical, biological, or radiological release to the environment • Major cyber-security penetration with significant loss of data • Major operational disruption to utility infrastructure • Malevolent act against an employee, guest, contractor, or member of the public • Significant exposure of any of the above to hazardous/toxic chemicals, biological agents, or radiation • Loss of DOE – ISM, ISO 14001, or OHSAS 18001 registration/certification • Significant regulatory violation/enforcement action • Major PAAA incident/fine • Major Loss or theft of property

39. BSA Level:High Risk Event/Risk Committee Alignment Audit & Finance • Major breakdown in internal controls • Significant undetected fraud/waste/abuse event • Sizeable unallowable cost • Major budget variance at institutional level • Loss of a major litigation with sizeable damages due • Failure to successfully implement high return on investment improvements

40. BSA Level:High Risk Event/Risk Committee Alignment Personnel & Compensation • Loss of a key scientist or support manager • Loss of DOE certification for HR Compensation System • Failure to attract a strategic scientific hire • Successful claim of discrimination • Inability to fill key leadership position on a timely basis

41. BSA Level:Risk Event/Risk Committee Alignment Institutional Strategy • Publication of fraudulent scientific result • Major loss of programmatic funding • Extended outage of a major user facility • Failure to achieve programmatic commitments • Loss of elected official/community support • Significant adverse media coverage • Failure to achieve a key strategic partnership

42. What Does it ALL Take !!!!

43. First Quarter FY05 Final Risk Packages To Risk Committee Chairs Assurance Letter To DOE Draft 4th Qtr Risk Packages to BSA Board Draft Assurance Letter To BSA Board Chair ASSURANCE PROCESS Independent Verification Activities FY05 YEAR-END SELF-EVAL. S&T / OPNS C.O. Metrics & Accomplishments Relevant Facts & Areas for Improvement Draft for Internal Review Develop Set of Institutional Performance Measures (Director’s Retreat) LAB QTRLY. PERFORMANCE REPORT Director’s Retreat FY05 S.A. Results FY06 S.A. Plans FY06 Inst. Measures Finalize Lab Agenda C.O. Mgmt. Systems Institutional Perf. (Qtr. & Year-End Roll-Up) FY06 Lab S.A. Plan Briefing to Policy Council INSTITUTIONAL PERFORMANCE METRICS Briefing to Mgmt. Council FY06 LAB S.A. PLAN Briefing to BHSO External Mgmt. System Targeted S.A. Req’d Line Complete Documents / Publish on SBMS System SBMS COMPLETION PROJECT FY06 Risk Metrics 1ST Qtr. Self Assessment Results by Management System Stewards 1st Qtr FY06 Performance Review Institutional Performance Metrics DATA CALLS Final Set from BHSO FY05 EMPLOYEE PERFORMANCE APPRAISAL FY06 EMPLOYEE GOAL SETTING R2A2 REVIEW / UPDATE FY06 PEMP

44. October 2005 ASSURANCE PROCESS Draft 4th Qtr Risk Packages to BSA Board FY05 YEAR-END SELF-EVAL. S&T / OPNS C.O. Metrics & Accomplishments Relevant Facts & Areas for Improvement LAB QTRLY. PERFORMANCE REPORT Draft for Internal Review C.O. Mgmt. Systems Institutional Performance (Qtr. & Year-End Roll-Up) Briefing to Policy Council Briefing to BHSO Complete Documents / Publish on SBMS System FY05 EMPLOYEE PERFORMANCE APPRAISAL FY06 EMPLOYEE GOAL SETTING R2A2 REVIEW / UPDATE Final Set from BHSO SBMS COMPLETION PROJECT FY06 PEMP

45. November 2005 ASSURANCE PROCESS INSTITUTIONAL PERFORMANCE METRICS Draft Assurance Letter to BSA Board Chair Final Risk Packages Risk Committee Chairs LAB QTRLY. PERFORMANCE REPORT Independent Verification Activities C.O. Mgmt. Systems Institutional Perf. (Qtr. & Year-End Roll-Up) Director’s Retreat FY05 S.A. Results FY06 S.A. Plans FY06 Inst. Measures Finalize Lab Agenda FY06 LAB S.A. PLAN Briefing to Management Council Develop Set of Institutional Performance Measures (Director’s Retreat) FY06 Lab S.A. Plan SBMS COMPLETION PROJECT Complete Documents / Publish on SBMS System FY05 EMPLOYEE PERFORMANCE APPRAISAL / FY06 EMPLOYEE GOAL SETTING R2A2 REVIEW / UPDATE

46. December 2005 ASSURANCE PROCESS FY05 YEAR-END SELF-EVAL. S&T / OPNS C.O. Metrics & Accomplishments Relevant Facts & Areas for Improvement FY05 EMPLOYEE PERFORMANCE APPRAISAL FY06 EMPLOYEE GOAL SETTING R2A2 REVIEW / UPDATE Assurance Letter To DOE FY06 Risk Metrics 1ST Qtr. Self Assessment Results by Management System Stewards 1st Qtr FY06 Performance Review Institutional Performance Metrics Complete Documents / Publish on SBMS System SBMS COMPLETION PROJECT DATA CALLS

47. Summary Successes & Failures Discussion Future Challenges