What PHMSA Is Actually Looking For When They Audit Your Alarm Program

 

The PHMSA inspector is not there to count your alarms.

Control room managers preparing for a CRM inspection often focus on performance metrics and rationalization documentation. Those matter. But what inspectors are actually evaluating is whether the organization has been intentional and accountable over time.

The documentation is evidence of that intention, or its absence. The alarm counts are a symptom. The audit is looking for the underlying condition.

Understanding that distinction is the difference between an audit that produces findings and one that does not.

 

What 49 CFR Part 192 and 195 Actually Require

The Control Room Management rule, codified in 49 CFR Part 192 for gas pipelines and Part 195 for hazardous liquids, established alarm management as a formal regulatory obligation for pipeline operators when it took effect in 2010. The requirements have been refined since, but the core obligation has not changed: pipeline operators must have a written alarm management plan, must monitor and respond to alarms in a way that supports controller effectiveness, and must review and update that plan on a defined schedule.

The rule does not specify alarm counts. Instead, it expects operators to show a managed, documented, and continually improving approach to alarm system performance. PHMSA guidance makes clear this means more than having a written plan.

Operators with findings in PHMSA audits typically failed not because of high alarm rates or incomplete documentation, but because they could not demonstrate that the plan was followed, responsible parties were identified, or performance data was reviewed and acted on.

PHMSA is not auditing your alarm system. They are auditing your alarm program. The difference is everything.

 

 

The Four Things Inspectors Look For

Based on PHMSA inspection findings and the structure of the CRM rule itself, audits consistently probe four areas:

 

1. Written Plan Completeness and Currency

Your alarm management plan must address the specific elements required by the rule: how alarms are designed, how they are monitored, how controllers are expected to respond, and how the plan is reviewed and updated. Plans written at the time of rule implementation and not meaningfully updated since are a red flag.

Inspectors look for evidence that the plan reflects current operations. If your pipeline has added measurement points, changed control systems, or modified operating procedures since the plan was last revised, and the plan does not reflect those changes, that is a documentation gap with regulatory consequences.

 

2. Alarm Identification and Rationalization Evidence

The rule requires operators to identify and address ineffective alarms. This is where rationalization documentation becomes critical, not as a compliance checkbox but as evidence that the organization has actually looked at its alarm system and made deliberate decisions about what belongs there.

Inspectors want to see that rationalization has occurred, that it involved the right people, that findings were acted on, and that the process is ongoing rather than a one-time project. A rationalization report from five years ago, with no follow-up activity, does not demonstrate a managed program.

 

3. Performance Monitoring and Review

This is where many operators have the biggest gap. The CRM rule requires that operators monitor alarm system performance and use that data to identify problems and drive improvement. That means alarm rate data must be collected, reviewed by someone with authority to act on it, and tied to documented corrective actions when performance falls outside acceptable parameters.

Inspectors will ask who reviews alarm performance data, how often, and what happens when an issue is identified. If the answer is that reports are generated but nobody is specifically responsible for acting on them, that is a finding waiting to happen.

API RP 1167, developed for pipeline alarm management under PHMSA oversight, provides the performance benchmarks that inspectors reference. Operators demonstrating their program against RP 1167 metrics are in a stronger audit position.

4. Controller Fatigue and Alarm Response Capability

The CRM rule requires alarm management to support controllers’ ability to respond safely and effectively. Inspectors evaluate whether your alarm system is usable for operators under real shift conditions.

Excessive alarm rates, unacknowledged standing alarms, alarm floods during normal operations, and the absence of documented response procedures are all indicators that the system is not meeting this standard. An inspector who observes a console with dozens of active alarms during a site visit will ask pointed questions about how controllers are expected to manage that environment.

 

The Benchmarks: What the Numbers Actually Are

API RP 1167 Annex C provides the KPI framework that pipeline operators are expected to measure against and that PHMSA inspectors use as a reference. These are not aspirational targets. They represent the threshold between a system that supports controller effectiveness and one that does not.

The table below reflects the API RP 1167 benchmark values per controller position:

 

Metric (per Controller Position)	Acceptable Target	Maximum Manageable
Annunciated alarms per day	~150 alarms/day	~300 alarms/day
Annunciated alarms per hour	~6 alarms/hour	~12 alarms/hour
Annunciated alarms per 10 minutes	~1 alarm/10 min	~2 alarms/10 min
% of hours containing more than 30 alarms	<1%	<1%
% of 10-minute periods containing more than 5 alarms	<1%	<1%
Maximum alarms in any 10-minute period	10 or fewer	10 or fewer

 

A few things worth noting about these numbers:

The flood thresholds matter as much as the averages. An operator whose average rate looks acceptable but whose flood data shows frequent 10-minute periods exceeding 5 alarms has a program problem that averages alone will not reveal. According to Ecesis, inspectors with relevant expertise look for comprehensive alarm rationalization reviews that assess alarm set points, descriptions, and priorities each year, rather than relying solely on daily totals. These compliance benchmarks are intended to guide performance evaluations, not serve as pass or fail criteria under federal regulations. According to federal regulations, operators who are above targets are not automatically out of compliance, but they are required to measure their performance and address ongoing issues. Failing to document and evaluate these efforts can create a challenge during periodic reviews by regulatory agencies, emphasizing the importance of knowing and tracking your numbers. Not knowing them, when PHMSA asks, is itself an answer.

 

The Documentation That Actually Protects You

When PHMSA finds a deficiency, the consequence is not just a citation. It is a corrective action requirement, a follow-up inspection schedule, and, in some cases, civil penalty exposure. Operators who can demonstrate a documented, defensible program avoid most of this.

The documentation that matters most in an audit is not the prettiest report or the most comprehensive KPI dashboard. It is the paper trail that shows decisions were made deliberately and by accountable people.

That means keeping rationalization records showing who reviewed each alarm, their decisions, and when. Performance review records must show who received the data and what actions followed. Change management records must show alarm modifications that underwent review before implementation. A written plan should be updated to reflect program evolution.

None of this requires sophisticated software. It does require organizational discipline and a clear ownership structure. The facilities that sail through PHMSA audits are not necessarily the ones with the best alarm performance metrics. They are the ones that can demonstrate, document by document, that someone has been paying attention.

The real question an inspector asks is not simply about alarm configuration. It is whether your organization consistently demonstrates responsible stewardship of a safety-critical system—both in documented actions and daily practice. That distinction determines not only audit outcomes but also your broader reputation for safety and compliance.

Where Programs Break Down

The most common failure mode in pipeline alarm programs is not a gap in the written plan. It is the gap between the written plan and actual practice.

Plans that require quarterly alarm performance reviews, but have no evidence that they occurred. Rationalization procedures that specify a cross-functional review team but show sign-offs only from one department. Change management policies that cover physical assets but have never been applied to alarm setpoint modifications.

These gaps develop gradually and without drama. A quarterly review is being pushed back due to an operational priority. A setpoint change gets made informally because the formal process feels like overhead. A rationalization project is completed, but ownership of ongoing maintenance is never assigned.

Each of these is a reasonable accommodation to operational pressure in isolation. Cumulatively, they produce a program that looks compliant on paper and is not compliant in practice. That is exactly the gap a skilled PHMSA inspector is trained to find.

 

Preparing for the Audit You Have Not Scheduled Yet

Pipeline operators do not always know when a PHMSA audit is coming. Inspections can be triggered by incidents, complaints, or simply by the inspection cycle reaching your facility. The operators who manage audits most effectively treat audit readiness as an ongoing operational state rather than a sprint of preparation.

That means keeping rationalization documentation up to date rather than letting it accumulate into a backlog. It means ensuring that alarm performance reviews occur on schedule and produce documented outcomes. It means verifying that the people responsible for alarm management under your written plan are actually performing those responsibilities and that evidence exists to demonstrate it.

It also means understanding your actual alarm performance against the API RP 1167 benchmarks. According to the Federal Register, pipeline operators should make sure their performance data aligns with established parameters and address any issues before they are flagged by inspectors. The pipelines most likely to face PHMSA attention are not always those with the largest budgets or most advanced systems, but those whose operations are inconsistent with regulatory requirements. They are the ones who have built alarm management into how they operate, not as a compliance burden to be managed around, but as a genuine reflection of how seriously they take controller safety and operational reliability.

That is the program PHMSA is looking for. And it is the program that protects operators, controllers, and the public when things get hard.