15. Risk, Governance, Sustainability and Future Reliability

Introduction and Context

Maintenance and reliability management has traditionally concentrated on preserving equipment function, reducing failures, and controlling life-cycle cost. At enterprise level, however, these objectives are inseparable from wider questions: Is the asset safe to operate? Is its environmental impact acceptable? Can management demonstrate that decisions were properly authorized and recorded? Will the asset remain dependable under climate stress, cyberattack, supply disruption, or changing regulation? These questions expand reliability from a technical discipline into a matter of governance, corporate responsibility, and strategic resilience.

An enterprise asset-management (EAM) strategy therefore has to connect maintenance engineering with occupational safety, environmental management, financial control, information security, ethics, and sustainability. A technically reliable asset may still be unacceptable if it creates intolerable safety risk, violates emissions requirements, consumes scarce resources inefficiently, or depends on undocumented expert knowledge. Conversely, sustainability initiatives that ignore maintainability may increase failure frequency and operational risk.

This chapter examines the integration of risk, governance, sustainability, assurance, and emerging technologies into reliability management. It emphasizes managerial judgement: deciding which risks require elimination, reduction, transfer, monitoring, or acceptance, while ensuring that decisions remain transparent and defensible.

Learning Objectives

After studying this chapter, the learner should be able to:

1. Explain the relationship between reliability, safety, governance, sustainability, and enterprise risk.

2. Apply risk-based decision frameworks to maintenance and asset-management problems.

3. Distinguish compliance, assurance, auditability, and ethical accountability.

4. Integrate environmental, climate, circular-economy, and life-cycle considerations into maintenance strategy.

5. Evaluate the opportunities and limitations of autonomous maintenance, artificial intelligence, digital twins, and connected assets.

6. Develop governance arrangements and performance measures for responsible reliability management.

7. Analyse a complex asset-management situation and recommend a defensible course of action.

Reliability as an Enterprise Governance Issue

Reliability is the probability that an item will perform a required function under stated conditions for a specified period. In practice, that probability is influenced not only by design and maintenance, but also by procurement quality, operating discipline, competence, spare-parts availability, data integrity, contractor control, and organizational culture. Reliability is consequently a socio-technical property of a system rather than a characteristic of equipment alone.

Governance refers to the structures and processes through which an organization is directed, controlled, and held accountable. In maintenance, governance determines who can approve risk acceptance, how criticality is established, which evidence is required before returning equipment to service, and how conflicts between production and safety are resolved. Good governance prevents reliability decisions from becoming informal negotiations based on urgency or personal influence.

Three lines of responsibility are useful. Operational and maintenance personnel own day-to-day controls and identify emerging hazards. Specialist functions such as reliability engineering, safety, environment, quality, and cybersecurity provide independent expertise and challenge. Internal audit or an equivalent assurance function evaluates whether controls are designed and operating effectively. The board or senior leadership remains accountable for the organization’s risk appetite and major investment decisions.

A mature governance system establishes a clear chain from organizational objectives to asset policies, maintenance strategies, work instructions, records, and performance review. It also defines escalation thresholds. For example, a failed inspection on a low-criticality utility may be managed through planned repair, whereas degradation of a pressure boundary may require immediate isolation, formal risk assessment, and executive notification.

Risk-Based Reliability Decisions

Risk is commonly expressed as a combination of the likelihood of an undesired event and its consequence. This formulation is useful but incomplete unless the organization also considers uncertainty, exposure duration, detectability, and the effectiveness of existing controls. Consequences may include injury, fatality, environmental release, product loss, regulatory sanction, reputational damage, and interruption of critical services.

A risk-based maintenance process usually follows these steps:

1. Define the asset, function, operating context, and credible failure scenarios.

2. Identify hazards, failure modes, causes, consequences, and existing safeguards.

3. Estimate likelihood and consequence using an agreed method.

4. Determine whether risk is tolerable against legal requirements and organizational criteria.

5. Select controls according to the hierarchy of controls.

6. Assign ownership, deadlines, and verification requirements.

7. Monitor leading and lagging indicators and reassess when conditions change.

The hierarchy of controls gives priority to elimination, substitution, engineering controls, administrative controls, and personal protective equipment, in that order. Maintenance departments sometimes overuse procedures and training when a design modification could remove the hazard altogether. For example, relying on workers to remember isolation requirements is weaker than installing an interlocked isolation system with independent verification.

Failure Mode and Effects Analysis (FMEA) supports systematic evaluation of how components can fail and what effects those failures produce. Reliability-Centered Maintenance (RCM) extends this logic by selecting technically feasible and economically justified tasks according to the consequences and characteristics of functional failures. Fault-tree analysis reasons deductively from a top event to combinations of causes, while event-tree analysis follows possible consequences after an initiating event. Layers of Protection Analysis examines whether independent safeguards are sufficient for a hazardous scenario.

These methods should not be treated as paperwork exercises. Their value depends on accurate operating information, participation by people who understand the work, realistic assumptions, and implementation of resulting actions. A risk register that contains unverified statements is not evidence of control.

Assurance, Auditability, and the Quality of Evidence

Assurance is the systematic provision of confidence that controls, processes, and results are reliable. It differs from inspection, which is one control activity, and from audit, which evaluates conformity and effectiveness against defined criteria. Auditability means that a competent reviewer can reconstruct what was decided, by whom, on what evidence, and with what result.

An auditable maintenance process normally preserves:

• asset identity, criticality, and functional requirements;
• approved maintenance strategies and their technical basis;
• inspection, test, calibration, and work-completion records;
• defect assessments, concessions, and risk acceptances;
• competence and authorization records;
• management-of-change documentation; and
• evidence that corrective actions were closed and verified.

Data integrity is central. A completed work order does not necessarily prove that the task was performed correctly. Good systems distinguish between planned, attempted, completed, verified, and effective work. Sampling, field observation, independent inspection, and post-maintenance testing may be required for high-consequence assets.

Assurance should be proportionate to risk. Excessive approval layers can slow response without improving control, while inadequate independence can allow production pressure to obscure unsafe conditions. The appropriate question is not whether an organization has many audits, but whether assurance detects important weaknesses before they become failures.

Ethics and Professional Accountability

Maintenance professionals frequently face ethical conflicts. A supervisor may be pressured to defer an inspection to meet a production target. An engineer may be asked to report a predicted failure as unlikely because replacement funding is unavailable. A contractor may be encouraged to close work orders without sufficient evidence. These are not merely procedural issues; they concern professional integrity and the protection of people, communities, and the environment.

Ethical reliability management requires truthful reporting, respect for competence limits, protection of persons who raise concerns, avoidance of conflicts of interest, and willingness to stop work when necessary. Performance incentives should not reward low reported failure rates if the result is under-reporting. Similarly, an availability target must not encourage bypassing protective devices or extending equipment beyond safe operating limits.

Organizations should provide escalation routes independent of the immediate line manager, define non-retaliation expectations, and train leaders to respond constructively to bad news. Ethical culture is demonstrated most clearly when inconvenient evidence is acted upon rather than suppressed.

Sustainability and Life-Cycle Asset Management

Sustainability in maintenance extends beyond reducing energy consumption. It concerns the ability to meet present operational needs without undermining future environmental, social, and economic capacity. Life-cycle thinking considers design, procurement, installation, operation, maintenance, modification, decommissioning, reuse, and disposal.

Maintenance decisions influence sustainability through energy efficiency, lubricant and chemical consumption, emissions, water use, waste generation, component replacement, and asset life extension. Preventive replacement may reduce failure risk but generate unnecessary material waste. Repair and remanufacture may conserve resources, but only if restored components meet reliability and safety requirements. The correct decision requires a life-cycle comparison rather than a narrow focus on immediate maintenance cost.

Environmental compliance involves identifying applicable permits, emission limits, waste rules, chemical controls, spill-prevention obligations, and reporting requirements. Compliance should be incorporated into maintenance planning. For instance, inspection of a containment system is not merely a reliability task if failure could release hazardous material; it is also an environmental control with legal significance.

Circularity seeks to reduce virgin-material consumption and waste by designing for durability, repair, refurbishment, remanufacture, reuse, and responsible recycling. Reliability engineers can support circularity by specifying modular equipment, accessible components, standard interfaces, condition-based replacement, and supplier take-back arrangements. However, circularity must not be used to justify uncontrolled reuse of components whose history, material condition, or safety certification is uncertain.

Sustainability indicators may include energy intensity, maintenance waste per unit of output, percentage of materials recovered, fugitive-emission events, water consumption, asset life extension, and the environmental consequences of failure. These indicators should be interpreted alongside safety and reliability measures, not used in isolation.

Climate Resilience and Business Continuity

Climate-related hazards can alter failure probabilities and operating contexts. Heat may degrade insulation, lubricants, electronics, and human performance. Flooding can disable electrical systems and contaminate lubricants. Storms may interrupt power, logistics, communications, and access to remote sites. Drought can constrain cooling-water availability. The relevant issue is not only the frequency of extreme events but also the vulnerability and recovery capability of the asset system.

Climate-resilient reliability management includes hazard screening, updated design limits, site drainage and protection, redundant utilities, heat-resistant materials, emergency spares, remote monitoring, alternative suppliers, and tested recovery procedures. Criticality analysis should include dependencies such as power, telecommunications, digital services, transport, and external utilities.

Scenario analysis is valuable where historical data no longer represent future conditions. Organizations can examine plausible combinations such as prolonged heat, grid instability, restricted water supply, and delayed spare-parts delivery. The objective is not to predict one exact future but to identify strategies that remain effective across several credible futures.

Digital Reliability, Autonomy, and Cybersecurity

Connected sensors, industrial Internet of Things platforms, machine learning, digital twins, robotics, and mobile work systems are changing maintenance practice. Condition-monitoring data can support earlier detection of degradation, while analytics can estimate remaining useful life and prioritize work. A digital twin may combine design information, operating data, inspection history, and simulation to support decisions about asset health.

Autonomous or semi-autonomous maintenance includes automatic lubrication, robotic inspection, drone-based visual surveys, remote diagnostics, and systems that recommend or initiate work. These applications are most valuable where tasks are hazardous, repetitive, inaccessible, or data-rich. They do not eliminate the need for human accountability. A recommendation engine may identify an anomaly, but a competent person must determine whether the anomaly is real, significant, and actionable.

The principal risks include poor sensor quality, biased training data, model drift, false alarms, missed detections, opaque algorithms, insecure interfaces, and automation complacency. A predictive model trained on normal operating conditions may fail when equipment is modified or exposed to an unusual environment. Autonomous actions therefore require defined authority limits, fail-safe states, validation, change control, and human override.

Cybersecurity is a reliability concern because malicious alteration or loss of control systems can produce physical failure. Asset inventories, network segmentation, access control, patch governance, secure remote access, backup, incident response, and supplier assurance should be integrated with maintenance planning. Adding connectivity without protecting the control environment can increase rather than reduce risk.

An Integrated Strategic Framework

An effective enterprise reliability strategy can be organized around six connected questions:

1. Purpose: What functions and outcomes must the asset system deliver?

2. Exposure: What safety, environmental, operational, financial, cyber, and social risks arise from failure?

3. Control: Which design, maintenance, operating, and emergency controls reduce those risks?

4. Evidence: What information demonstrates that controls are effective?

5. Adaptation: How will the strategy respond to climate, technology, regulation, and organizational change?

6. Accountability: Who owns decisions, residual risk, resources, and review?

This framework links technical tools such as RCM and FMEA with management systems, assurance, sustainability, and resilience. It also supports alignment with recognized practices and standards, including asset-management principles associated with ISO 55000, occupational health and safety management, environmental management, quality management, functional safety, and industrial cybersecurity. Standards should be used as structured references and governance aids; certification alone does not guarantee reliable assets.

Performance management should combine outcome indicators and leading indicators. Outcomes include failures, injuries, releases, downtime, and cost. Leading measures include overdue critical inspections, bad-actor recurrence, deferred corrective work, alarm quality, competence gaps, audit findings, and completion of risk-reduction actions. A balanced dashboard prevents management from celebrating availability while hidden risk accumulates.

Illustrative Case: Resilient Reliability at a Chemical Processing Site

Background

The following fictional case illustrates an integrated approach. Meridian Chemicals operates a continuous process plant with electrically driven pumps, storage tanks, cooling systems, and a distributed control system. Production availability is commercially important, but several assets also have potential safety and environmental consequences.

Situation and Problem

The site experienced repeated seal failures on a solvent-transfer pump. Operators compensated by switching to a standby pump, and maintenance replaced seals whenever leakage became visible. The maintenance manager proposed a predictive-monitoring package. The environmental manager, however, noted that small leaks were already generating reportable waste, while the cybersecurity manager warned that connecting sensors to the control network could create a new exposure. A heatwave had also reduced cooling capacity and increased pump operating temperature.

Analysis

An FMEA identified several contributors: misalignment after overhaul, inadequate seal selection, thermal cycling, contaminated lubricant, and operation outside the pump’s preferred range. The consequence analysis showed that the issue was not simply a maintenance-cost problem. Leakage could expose workers, create emissions, contaminate drainage, and interrupt production. The existing strategy relied heavily on operator observation and lacked a verified post-maintenance alignment check.

A risk review classified the pump as safety and environmentally significant. The team also mapped dependencies: cooling-water availability, electrical supply, sensor communications, and competent contractor support. A purely predictive solution was rejected because data quality was limited and the model could not address design and operating causes.

Approach and Strategy

Meridian adopted a layered strategy. First, engineering reviewed seal design, pump operating range, alignment method, and cooling conditions. Second, laser alignment and independent verification were added to the overhaul process. Third, vibration, temperature, and leakage sensors were installed on a segregated monitoring network with controlled access. Fourth, inspection intervals were adjusted using condition data, but statutory and safety inspections remained mandatory. Fifth, a spill-response drill and environmental reporting protocol were revised. Finally, the site created an approval rule requiring safety, environmental, maintenance, and cybersecurity review before connecting new monitoring devices.

The reliability dashboard included seal-life distribution, unplanned change-outs, leakage events, overdue inspections, sensor availability, and verified corrective actions. Senior management reviewed residual risk quarterly rather than treating the project as complete after installation.

Outcome

In this illustrative case, the site reduced emergency interventions, improved evidence about failure causes, and gained earlier warning of abnormal temperature. More importantly, it prevented technology from being treated as a substitute for engineering control and governance. The project also showed that environmental performance and reliability performance could be improved through the same design intervention.

Learning Points

The case demonstrates that: risk is multidimensional; predictive maintenance is not automatically risk-based maintenance; digital systems require cybersecurity and data governance; assurance must verify effectiveness; and sustainable reliability often comes from eliminating recurring failure mechanisms rather than merely repairing them faster.

Challenges and Common Mistakes

Several weaknesses recur in organizations attempting to integrate these ideas. The first is compliance minimalism: meeting the wording of a requirement while ignoring its purpose. The second is fragmented ownership, in which maintenance, safety, environment, information technology, and finance optimize separate objectives. The third is risk-ranking inflation, where too many assets are declared critical and resources become diluted. The fourth is deferred maintenance without explicit residual-risk approval.

Other mistakes include treating historical failure data as complete, assuming that a sensor provides knowledge without validation, using availability as the dominant performance objective, failing to reassess risks after modification, and accepting supplier claims without independent verification. Organizations may also overinvest in sophisticated analytics while basic asset registers, failure coding, lubrication practices, or work-quality controls remain weak.

A further limitation is uncertainty. Not every consequence can be quantified precisely, and rare catastrophic events may have little statistical evidence. Structured expert judgement, conservative assumptions, scenario analysis, and independent challenge are therefore necessary. Risk models support decisions; they do not replace responsibility.

Current Developments and Best Practices

Emerging reliability practice is moving toward interoperable asset information, digital product passports, remote and robotic inspection, physics-informed analytics, edge computing, and more explicit integration of climate and biodiversity considerations. Generative AI may assist with work-order interpretation, troubleshooting, and knowledge retrieval, but its outputs require verification and controlled use. The long-term direction is not fully autonomous maintenance without people; it is a more adaptive system in which people supervise increasingly capable analytical and physical tools.

Best practice includes the following:

• establish asset criticality using safety, environmental, operational, financial, and social consequences;
• make risk acceptance explicit and time-bound;
• apply the hierarchy of controls before relying on procedures or protective equipment;
• maintain traceable, accurate, and access-controlled asset records;
• integrate maintenance, process safety, environmental, quality, and cybersecurity reviews;
• validate predictive models and monitor false positives, false negatives, and model drift;
• design for maintainability, repairability, energy efficiency, and eventual recovery of materials;
• test emergency, business-continuity, and cyber-incident arrangements;
• use independent assurance for high-consequence controls; and
• reward truthful reporting, learning, and risk reduction rather than superficial performance figures.

Chapter Summary

Strategic reliability management requires more than controlling equipment failures. It requires governance arrangements that clarify authority and accountability, risk methods that reflect safety and environmental consequences, assurance systems that produce credible evidence, and ethical practices that protect truthful reporting. Sustainability adds life-cycle, resource, emissions, circularity, and social considerations to maintenance decisions. Climate resilience requires analysis of changing hazards, dependencies, and recovery capability. Digital twins, condition monitoring, artificial intelligence, robotics, and autonomous systems can improve reliability, but they introduce data, cybersecurity, model, and accountability risks. An integrated EAM strategy aligns purpose, exposure, controls, evidence, adaptation, and ownership. The most mature organizations use technology selectively, apply independent assurance, and treat reliability as an enterprise responsibility.

Key Terms

Risk: The effect of uncertainty on objectives, commonly evaluated through likelihood and consequence.

Governance: Structures and processes used to direct, control, and hold an organization accountable.

Enterprise asset management: Coordinated management of assets and asset-related activities to achieve organizational objectives across the life cycle.

Assurance: Systematic provision of confidence that controls and processes are suitable and effective.

Auditability: The ability to reconstruct decisions, actions, evidence, and responsibilities through reliable records.

Residual risk: Risk remaining after controls have been implemented.

Risk appetite: The amount and type of risk an organization is willing to accept in pursuit of objectives.

FMEA: A structured method for identifying failure modes, their causes, effects, and controls.

Reliability-Centered Maintenance: A methodology for selecting maintenance policies according to functions, failure consequences, and technically feasible tasks.

Hierarchy of controls: A preferred order of risk controls from elimination through personal protective equipment.

Life-cycle thinking: Evaluation of impacts and decisions across design, operation, maintenance, and disposal.

Circularity: Retention of material and product value through repair, reuse, refurbishment, remanufacture, and recycling.

Climate resilience: The capacity of an asset system to withstand, adapt to, and recover from climate-related disruption.

Digital twin: A digital representation linked to an asset or system and informed by relevant data.

Predictive maintenance: Maintenance planned using indicators of future condition or failure probability.

Model drift: Decline in analytical-model performance as operating conditions or data relationships change.

Functional safety: The use of safety-related control systems to reduce risk to an acceptable level.

Management of change: A controlled process for assessing and authorizing modifications that may affect risk or performance.

Residual risk acceptance: Formal authorization to retain risk after considering feasible controls.

Leading indicator: A measure of conditions or actions that may predict future performance or failure.

Review Questions

Short Answer Questions

1. Why is reliability considered a socio-technical property rather than only an equipment characteristic?

2. Define auditability in the context of maintenance management.

3. What is the purpose of the hierarchy of controls?

4. How does circularity influence maintenance decisions?

5. Identify two cybersecurity risks associated with connected maintenance systems.

Long Answer Questions

1. Explain how governance arrangements influence risk-based maintenance decisions.

2. Discuss the relationship between assurance, audit, data integrity, and professional accountability.

3. Explain how sustainability and life-cycle thinking can alter preventive-maintenance policy.

4. Evaluate the benefits and limitations of artificial intelligence and autonomous maintenance.

5. Develop an integrated framework for climate-resilient enterprise asset management.

Analytical / Application Questions

1. A plant has excellent equipment availability but increasing overdue inspections and deferred corrective work. Analyse the governance and risk implications and recommend performance measures.

2. A company plans to connect remote sensors to a legacy control network. Prepare a decision approach covering reliability benefits, cybersecurity, assurance, data governance, and residual risk.

3. A critical pump can either be replaced at high cost or refurbished using recovered components. Compare the alternatives using safety, reliability, environmental, circularity, life-cycle cost, and accountability criteria.

22. Multiple Choice Questions with Answers

Question 1

Which statement best describes enterprise reliability governance?

A. It is limited to approving preventive-maintenance frequencies.

B. It defines authority, accountability, evidence, and escalation for asset-related decisions.

C. It replaces technical reliability analysis with financial reporting.

D. It transfers all maintenance decisions to external contractors.

Correct Answer: B. It defines authority, accountability, evidence, and escalation for asset-related decisions.

Question 2

A maintenance team relies on a procedure requiring workers to avoid a hazardous machine zone, although an interlocked guard could remove the exposure. Which principle suggests the preferred solution?

A. Risk transfer

B. Leading indicators

C. Hierarchy of controls

D. Circular procurement

Correct Answer: C. Hierarchy of controls

Question 3

What makes a maintenance process auditable?

A. A large number of completed work orders

B. The ability to reconstruct decisions, actions, evidence, and responsibilities

C. Use of the newest predictive-maintenance software

D. Approval of every task by the board

Correct Answer: B. The ability to reconstruct decisions, actions, evidence, and responsibilities

Question 4

Why may a predictive-maintenance project fail even when sensors are installed correctly?

A. Predictive maintenance cannot be used on rotating equipment.

B. Sensor data may be poor, models may drift, and underlying failure causes may remain untreated.

C. Environmental compliance prohibits condition monitoring.

D. Digital systems always eliminate human judgement.

Correct Answer: B. Sensor data may be poor, models may drift, and underlying failure causes may remain untreated.

Question 5

Which action best reflects life-cycle sustainability?

A. Selecting the cheapest component purchase price

B. Replacing all components at fixed short intervals

C. Comparing design, operation, maintenance, repair, and end-of-life consequences

D. Maximizing equipment utilization regardless of emissions

Correct Answer: C. Comparing design, operation, maintenance, repair, and end-of-life consequences

Question 6

A climate-resilience assessment should primarily examine which combination?

A. Only historical average temperature

B. Hazards, asset vulnerability, dependencies, and recovery capability

C. Only the age of mechanical equipment

D. Only insurance premiums

Correct Answer: B. Hazards, asset vulnerability, dependencies, and recovery capability

Question 7

What is the main ethical concern when production pressure leads to closing work orders without verification?

A. It increases spare-parts variety.

B. It creates a misleading record and may expose people and the organization to unmanaged risk.

C. It reduces the number of digital-twin variables.

D. It automatically improves availability.

Correct Answer: B. It creates a misleading record and may expose people and the organization to unmanaged risk.

Question 8

Which is an appropriate control before connecting new monitoring devices to an industrial control network?

A. Allow unrestricted remote access for convenience.

B. Skip cybersecurity review if the device improves reliability.

C. Use segregation, access control, validation, and change authorization.

D. Replace all statutory inspections with sensor readings.

Correct Answer: C. Use segregation, access control, validation, and change authorization.

Question 9

Why should leading indicators complement failure and downtime statistics?

A. Outcome indicators are never useful.

B. Leading indicators can reveal accumulating weaknesses before serious outcomes occur.

C. Leading indicators eliminate the need for audits.

D. They measure only financial performance.

Correct Answer: B. Leading indicators can reveal accumulating weaknesses before serious outcomes occur.

Question 10

In the illustrative chemical-plant case, why was a technology-only solution rejected?

A. The plant had no environmentally significant assets.

B. The recurring failure involved design, operation, maintenance quality, environmental exposure, and cybersecurity considerations.

C. Predictive systems cannot detect temperature changes.

D. The standby pump made all controls unnecessary.

Correct Answer: B. The recurring failure involved design, operation, maintenance quality, environmental exposure, and cybersecurity considerations.