Offshore personnel accountability should do more than confirm how many people have reached an assembly point. It should give the person in command a reliable, continuously updated basis for deciding who is at risk, which protective action is safest, and what must happen next.
When an alarm sounds offshore, speed matters. But speed can be measured too narrowly. A roll call completed a minute earlier is useful only if the result can be trusted and acted upon. It does not, by itself, explain whether an unconfirmed technician is still in an affected work zone, whether a response-team member is carrying out an assigned duty, whether a visitor has followed the wrong group, or whether someone has reached an alternative safe location because the primary route is compromised.
That distinction separates a headcount from a decision system. A headcount asks, “How many are here?” A decision system asks, “Who is exposed, who is safe, who is unconfirmed, where were they last reliably known to be, what role were they expected to perform, and which action now produces the safest outcome?”
International standards, US regulations, and industry guidance point in the same operational direction. For ships within its scope, SOLAS requires muster lists and emergency instructions to be provided and displayed in conspicuous onboard locations.1 US Outer Continental Shelf rules for manned facilities other than mobile offshore drilling units connect alarms, assigned emergency duties, station bills, communications, evacuation circumstances, transport limitations, and command authority.2 IOGP goes further in its operational definition: muster is the assembly of personnel in a safe area so that the emergency can be assessed and control can be taken.3 The count is therefore an input. The outcome is controlled action.
Requirements depend on the asset, flag State, operating area, and governing law. The international, US, and UK sources below are used as design benchmarks; they are not presented as the law governing every offshore operation.
The source of truth has to move with the operation
A manual personnel-on-board record can be accurate at the moment it is reconciled and already incomplete a short time later. That is not a criticism of the people maintaining it. It is a consequence of offshore work.
Personnel arrive and depart, shifts overlap, teams move between accommodation and operational areas, work scopes change, and access to a zone may be restricted without changing the total population. Contractors may be reassigned. Visitors may be escorted by someone other than the person named during induction. A specialist may leave a task temporarily but remain recorded against it. These are ordinary operational movements, yet each can alter the meaning of a muster exception.
The weakness is not simply that a record is manual. It is that updates can be separated from the operational event they represent. A name may appear in one place, an assignment in another, and a movement or restriction in a third. During an emergency, someone has to reconcile those fragments while the hazard is developing.
A reliable accountability model therefore needs controlled state changes. Joining, departing, changing shift, accepting a critical duty, entering a restricted work zone, moving to an alternative muster point, and leaving the installation should each update the same operational picture, directly or through governed integration. Every update needs a source, a time, and an owner. If two sources disagree, the conflict should be visible rather than silently resolved in favour of whichever record was opened first.
This does not require continuous surveillance of every person. It requires enough current, proportionate information to answer emergency questions. The distinction matters. An organisation can minimise personal data while still knowing that an individual is on board, assigned to a work area, expected at a particular muster location, qualified for a response role, or likely to need assistance.
“Missing” must be an operational status, not a blank space
Binary labels create dangerous ambiguity. “Present” might mean physically verified at a safe location, reported by a team leader, detected by a system, or merely expected on board. “Absent” might mean confirmed ashore, assigned elsewhere, performing an emergency duty, unable to reach the primary station, or genuinely unconfirmed.
A decision-grade system preserves those differences. It distinguishes directly verified safe, verified safe at another location, engaged in an assigned response, evacuated, confirmed off the installation, requiring assistance, and unconfirmed. It also shows the basis and freshness of each status. A direct check at a muster point is not the same evidence as an inference from an earlier work assignment, and a report made moments ago is not equivalent to one made before a shift transition.
This is where the language used by the control room becomes consequential. “Not at primary muster” should not automatically become “missing”. The first statement is an observation. The second should mean that available sources have been checked, known alternatives have been reconciled, and the person’s safety remains unverified. The purpose of that sharper definition is to avoid complacency and unnecessary exposure of search teams.
The objective is not to make uncertainty disappear. Emergencies rarely allow that. It is to make uncertainty explicit, bounded, and actionable. Command should be able to see which cases are unresolved, which evidence has already been tested, who owns the next check, and when escalation is due.
The safest destination can change with the hazard
Traditional muster thinking often assumes one correct destination. Offshore emergency response is more conditional. Fire, smoke, toxic gas, loss of containment, structural damage, severe weather, and impaired access can make the normal route or primary muster area the wrong choice for people starting from a particular location.
HSE’s offshore inspection guidance expects primary and alternative muster arrangements for foreseeable circumstances, including situations in which the incident compromises a primary point or prevents personnel from reaching it. It also expects current assignment lists at muster locations.4 IOGP similarly notes that sending everyone to a primary point may expose some workers to greater risk and that a secondary point may be the safer destination even when the usual route is not yet physically blocked.3
This changes the command question. The goal is not necessarily to bring every person to the same place. It is to get every person to the safest viable state for the developing scenario and to account for them there.
For one group, that may mean sheltering in a protected refuge while conditions are assessed. For another, it may mean moving to an alternative muster area. A response team may need to remain at an assigned station. An injured person may require assisted movement. If the refuge or route is likely to become impaired, controlled evacuation may need to begin before the situation removes that option. Escape is a last resort when planned evacuation is unavailable or has failed; IOGP’s escape, evacuation, and rescue model deliberately treats these as distinct stages with different risks and decision points.3
US Coast Guard emergency evacuation requirements reflect the same decision logic. Plans for manned Outer Continental Shelf facilities must define the circumstances that could place personnel in jeopardy, the order of evacuation, the resources and operational limitations involved, and the time and distance factors for initiation.2 Accountability information should feed those choices. If it does not, the muster process is operating beside the emergency plan rather than as part of it.
Contractors and visitors cannot sit outside the model
An emergency does not respect employment categories. Everyone exposed to the hazard contributes to the accountability problem, while some people also carry specialist knowledge or duties that affect the response.
BSEE’s SEMS requirements explicitly include contractor personnel in periodic emergency-response and evacuation training and drills.5 HSE’s guidance on safety-critical communication likewise addresses employees, contractors, and visitors, and highlights induction, emergency instructions, and evacuation drills as information all personnel may need.6 A detached guest log is therefore insufficient on its own if it cannot be reconciled immediately during an alarm.
At check-in, each person needs an accountable identity, a host or supervisor, a current muster assignment, the emergency information appropriate to their role, and any relevant assistance requirement. When their location, escort, or work scope changes, the accountable state must change with it. One practical control is to use a contractor supervisor’s group report to supplement individual verification rather than replace it. During evacuation, the system should preserve who has moved, by which means, and to which safe destination.
For mobile offshore units, Coast Guard requirements make the inclusion explicit: the muster list must cover arrangements for mustering and controlling visitors and other people on board, as well as substitutes for key personnel who may be unable to perform their duties.7 Where OSHA’s emergency-action-plan provision applies, the plan must also include procedures for accounting for every employee after evacuation.8
Shift handover is a transfer of emergency knowledge
Shift change can create avoidable ambiguity unless accountability is transferred explicitly. The total on board may be correct while responsibility is not. One supervisor may believe an exception belongs to the outgoing team; the incoming team may assume the person has departed. Emergency roles can be duplicated on a roster or left without a competent assignee. Open work can move ownership without its location context moving with it.
The answer is an explicit transfer of accountability, not another static list. The incoming responsible person should acknowledge the current population, unresolved discrepancies, occupied or restricted zones, active work, temporary impairments, emergency-role coverage, and changes to muster or evacuation arrangements. Unresolved items should remain open across the handover rather than disappearing into narrative notes.
Regulation recognises that personnel change affects readiness. For a mobile offshore drilling unit subject to the cited US Coast Guard rule, abandonment and fire drills must be held within 24 hours when more than 25 per cent of those on board have not taken part in those drills on that unit during the previous month.7 HSE also identifies shift communication and handover as a key safety-critical communication issue, particularly at major-hazard sites.6 A decision system makes that continuity visible before an alarm tests it.
Drills should test decisions, not choreography
A familiar drill can produce a fast, clean result while leaving the real weaknesses untouched. People know the alarm, take the usual route, report to the usual station, and wait for the exercise to end. That tests recall. It does not necessarily test the organisation’s ability to manage uncertainty.
BSEE requires SEMS emergency plans to be ready for immediate implementation, validated through realistic scenarios, and followed by analysis and critique to identify and correct weaknesses.5 Coast Guard rules require realistic emergency drills and detailed records of participation, equipment problems, and corrective action.7 The standard is therefore closer to demonstrated capability than ceremonial compliance.
A useful accountability drill introduces friction. A normal route is unavailable. The primary muster area is unsuitable for one work zone. A person expected to have departed is still shown on board. A contractor group is split. A key supervisor is unavailable. Communications degrade. One report conflicts with another. The exercise then measures whether command can establish a trustworthy baseline, classify exceptions, choose protective actions, communicate them, and close the loop without sending people towards a greater hazard.
Completion time still matters, but it should be measured alongside decision quality. How long did it take to obtain a reliable initial picture? How quickly were unconfirmed cases narrowed? Did every status have evidence? Were search or evacuation decisions traceable to the information available at the time? Did corrective actions have owners, and were they later verified? Those measures turn drills into improvement mechanisms.
Degraded communications must be a designed mode
Offshore accountability depends on communication, so loss of a channel cannot be treated as an edge case. Power interruption, radio congestion, noise, damaged equipment, network isolation, and conflicting verbal reports can all fragment the operating picture precisely when it matters most.
US emergency evacuation plans must identify communications equipment, available frequencies, and schedules with relevant external parties.2 BSEE guidance on evacuation drills also emphasises verifying that communication systems remain active throughout a response-plan activation.9 Robust design starts with that expectation but does not assume every channel will remain available.
Continuity arrangements should allow accountability to continue locally when connectivity is lost, using a verified offline view, resilient communications, or another controlled fallback appropriate to the installation. Teams need a simple way to record verified status, clear rules for message precedence, and an agreed method for reconciling updates when contact returns. Every status should display its time and source so that stale information cannot masquerade as live certainty. Independent channels should use consistent identity and status language; redundancy is valuable only if the resulting reports can be reconciled.
Degraded mode also requires local decision rights. If a team cannot reach central command and its route becomes unsafe, personnel need pre-agreed authority to use the alternative protective action for that scenario and a way to report the decision when possible. Central coordination remains essential, but resilience depends on safe action at the edge.
Evidence is part of the safety control
An accountability system is incomplete if it can show the current state but cannot explain how that state was reached. During a drill, audit, investigation, or real event, the evidence must answer who changed a status, when it changed, what source supported it, what conflict or exception existed, what decision followed, and when the issue was closed.
That expectation is visible in the rules. Coast Guard requirements call for drill and training records that identify participants, equipment used, faults found, and corrective action; casualty-related records can include the personnel list.7 BSEE’s own inspection findings have highlighted emergency plans that were not current, contained incorrect contact information, or could not be supported by proof that required medical-emergency drills had occurred.10
Evidence should therefore be created as a by-product of doing the work, not reconstructed afterwards. A time-ordered event record can preserve roster changes, acknowledgements, alarms, status reports, command decisions, messages, escalation, and corrective actions under appropriate access and retention controls. It should also preserve uncertainty honestly: replacing an unconfirmed status with a convenient assumption creates a cleaner dashboard and a weaker safety record.
Build one operating picture around the decision
The goal is not a single application that replaces every offshore system. It is a governed operating picture that brings the minimum decision-critical information together and gives each source a defined role.
The personnel record establishes who is on board. Work and access information adds relevant location or zone context. Duty assignments show who is expected to act. Muster verification establishes who is safe and where. Hazard and route information shapes the appropriate protective action. Communications carry instructions and acknowledgements. The event record preserves evidence. Where sources disagree, explicit precedence and human confirmation resolve the exception.
AtlasNXT can provide a coordination layer around these decisions. It brings relevant people and locations into a shared incident environment, supports targeted communications and acknowledgements, manages assigned actions, and preserves a time-stamped incident timeline. Existing offshore systems retain their specialist roles, and accountable leaders retain command.
The strongest implementation starts with decision design. Define the questions command must answer for the credible scenarios. Define the minimum data needed to answer them, the systems or people authorised to provide it, the point at which it becomes stale, and the fallback when it is unavailable. Then configure workflows, roles, integrations, and evidence around those decisions. Technology should shorten the path from signal to safe action, while keeping accountable people firmly in control.
From counted to accounted for
A faster headcount is valuable. It is not the end state.
Offshore leaders need to know whether the population baseline is trustworthy, whether each person’s status is verified, whether the expected destination is still safe, whether critical roles remain covered, whether communication is working, and what evidence supports the next command decision. That capability has to survive routine movement, contractor turnover, shift change, ambiguous status, and degraded conditions.
When muster is designed as a decision system, accountability becomes active rather than administrative. It helps command protect people according to the hazard in front of them, not the assumptions captured earlier.
Book an AtlasNXT demonstration to examine how your current personnel, muster, communication, and emergency workflows support those decisions. The conversation can begin with one credible scenario and map the path from alarm to verified safety.
References
1. International Maritime Organization, List of Certificates and Documents Required to Be Carried on Board Ships, 2022, FAL.2/Circ.133–MEPC.1/Circ.902–MSC.1/Circ.1646–LEG.2/Circ.4, Annex, p. 6. Circular.
2. eCFR, 33 CFR Part 146, §§ 146.105–146.140. Regulatory text.
3. IOGP Report 434-19, Risk Assessment Data Directory – Escape, Evacuation, and Rescue, Version 2.0, July 2023. Report.
4. HSE, The Offshore Emergency Response Inspection Guide, Appendix 6, “Access / egress routes and mustering”. Guidance.
5. eCFR, 30 CFR § 250.1918. Regulatory text.
6. HSE, Safety-critical communications: Overview. Guidance.
7. eCFR, 46 CFR §§ 108.901, 109.213, and 109.415. Muster, drills, and records.
8. eCFR, 29 CFR § 1910.38. Regulatory text.
9. BSEE, Hoisting evacuation must be included in emergency response plans, Safety Bulletin 018. Bulletin.
10. BSEE, Medical evacuation and emergency hazards during risk-based inspections, Safety Alert 469. Alert.
