State of distributed-asset safety governance in Indian fuel retail

Executive summary

The Indian fuel-retail sector operates one of the world's largest distributed-asset safety footprints — more than 43,000 retail outlets across three PSU majors, plus rapidly growing private- sector and joint-venture networks. The safety posture across this estate has improved materially over the past decade through investment in corporate standards, training, technology, and independent assurance. The pattern is not uniform across operators, regions, or outlet vintages, and the improvement trajectory varies materially by operating discipline rather than by corporate intent.

This report draws on the combined practice's sustained engagement across the three Indian fuel-retail majors — IOCL, BPCL, and HPCL — over more than a decade of audit programmes. The observations below are aggregated and anonymised from that engagement base; specific operator detail is not disclosed except where the operator has cleared the disclosure for publication and the information is material to the sector picture.

The headline observation: the safety posture across the Indian fuel-retail sector is fundamentally sound at the corporate-standard level but variable at the outlet-operating-reality level. The gap is not in policy or in resource availability. The gap is in the operating disciplines that translate corporate standards into sustained outlet-level operating practice. Where those disciplines are strong, outlet-level safety posture is consistent with corporate intent. Where they are weak, substantial gaps accumulate quietly between regulatory inspections.

Sector context

The scale dimension

The Indian fuel-retail sector reaches every populated geography in India through a combined network that exceeds 80,000 outlets when private-sector and joint-venture operators are included. The three PSU majors — Indian Oil Corporation (IOCL), Bharat Petroleum (BPCL), and Hindustan Petroleum (HPCL) — together operate over 43,000 outlets, the dominant fraction of the network. Each major operates through a federated structure of regional offices, sales territories, and dealer-operated outlets, with corporate-level safety standards that exceed statutory minimums and that the dealers are contractually obliged to implement.

Beyond retail, each major operates refinery and infrastructure assets — IOCL with seven refineries, BPCL with refineries including Bina, HPCL with multiple refineries across the country — providing the upstream and processing capacity for the retail network. The combined PSU operating estate is one of the most operationally complex industrial sectors in the country, and its safety governance has evolved accordingly.

The regulatory framework

Fuel-retail outlet safety in India operates under a multi-layered regulatory framework. The Petroleum Act 1934 and Petroleum Rules 2002 provide the statutory basis. PESO — the Petroleum and Explosives Safety Organisation under DPIIT — administers licensing. The Oil Industry Safety Directorate (OISD) publishes operational standards that PESO references in licensing assessments. State fire safety regulations, electricity rules, factories acts, and environmental regulations layer additional requirements. The Indian Standards (IS codes) provide engineering specifications applicable to dispensers, tanks, electrical installations, and ancillary equipment.

The framework is mature, comprehensive, and well-understood by operators. It is also dense enough that operating-stage compliance requires sustained discipline; one-time licensing approval does not translate automatically into sustained compliance over an outlet's twenty- or thirty-year operating life.

The distributed-asset operating reality

The defining characteristic of fuel-retail safety governance is the distributed-asset reality. Outlet-level safety depends on operating practice at every outlet, every day, by personnel who typically did not write the corporate standards and whose primary objective function is reliable fuel dispensing and customer service. The corporate safety standard exists; whether it is instantiated in outlet operating reality is a separate question.

At outlet operating scale, the safety posture drifts predictably. Newly commissioned outlets begin with high compliance — the construction work was inspected, the equipment is new, the staff is freshly trained, the SOPs are recent. Compliance erodes through three mechanisms:

• Equipment-related drift— equipment ages, gaskets degrade, electrical installations accumulate modifications, fire-fighting equipment passes test dates, hose connections develop minor leaks. None of these is dramatic individually; cumulatively they degrade the outlet's safety posture below what the licence assumes.
• Workforce-related drift — staff turnover at outlet level is high; training records often lag the actual operating workforce; safety procedural shortcuts compound over thousands of dispensing transactions; emergency response familiarity decays without periodic exercise.
• Behavioural drift — housekeeping standards relax; ignition-source control becomes less rigorous; vehicle and pedestrian flow management becomes informal; smoking discipline at and around outlets degrades despite signage.

Any one of these is recoverable. All three operating in parallel across thousands of outlets, unobserved by corporate safety functions whose visibility is limited to periodic inspection cycles, produces a quiet erosion of the sector's actual safety posture relative to its policy intent. Independent third-party assurance is the principal mechanism by which corporate safety functions surface this drift before it becomes consequential.

Where the sector is strong

Corporate-level standards

All three PSU majors operate corporate safety standards that meet or exceed statutory minimums. SOPs cover construction, equipment maintenance, dispensing operations, electrical safety, fire-fighting infrastructure, emergency response, and personnel safety. The standards are reviewed and updated periodically. New regulatory developments — strengthened PESO requirements, OISD standard revisions, IS code updates — are typically incorporated within reasonable timeframes.

The corporate-level capability is not the safety governance gap. Operators that have invested substantially in standards documentation, training infrastructure, and corporate-level safety functions have built credible operating frameworks at policy level.

New-outlet commissioning discipline

Pre-commissioning safety inspection at new outlets is generally substantive. PESO closing inspections, corporate safety closure inspections, and independent third-party verification (where commissioned) produce outlets that enter service in compliance with the standards in force. The construction-stage gaps that do surface tend to be technical specification deviations (hazardous-area classification edge cases, vent height conformity, minor clearance variances) rather than fundamental safety deficiencies.

Investment in safety technology

The sector has invested materially in safety technology over the past decade: automatic dispenser shutdown systems, vapour-recovery technology, advanced fire-detection and suppression systems, electronic point-of-sale integration with safety interlocks, CCTV coverage that supports both security and safety observation. The technology base has improved the inherent safety capability of the network materially relative to a decade ago.

Where the sector is weaker

Operating-stage compliance verification

The most consistent gap surfaced across audit programmes at all three PSU majors is operating-stage compliance verification at outlet scale. Corporate standards exist; periodic regulatory inspections occur; but the sustained outlet-level verification that catches operating drift between inspections is the discipline most variably implemented across the sector.

The gap is structural. Internal corporate safety functions cannot maintain inspection cadence across thousands of outlets at the depth that the operating reality requires. Regulatory inspections occur infrequently and are necessarily focused on subset issues. The remaining inspection capacity, at network scale, comes from independent third-party assurance — which not all operators commission at the cadence or depth that the network requires.

Hazardous-area classification maintenance

Outlets undergo modifications during their operating life: canopy replacements, dispenser upgrades, ancillary equipment additions (CNG installations, EV charging in some networks), electrical capacity upgrades. Each modification should trigger hazardous-area classification review. In practice this review is often deferred or omitted, and hazardous-area zones drift away from the as-built certification basis. Audits surfacing this consistently find that electrical equipment installed in post-modification zones may not match the hazardous-area requirements that revised zoning would imply.

Fire-fighting infrastructure operational readiness

Fire-fighting installations are typically present and visible at outlets. Their operational readiness — periodic test outcomes, accessibility under emergency conditions, training of outlet staff to actually use them — is materially more variable than their presence. Audits consistently surface fire-fighting equipment that has not been substantively tested within the prescribed cadence, extinguishers missing service tags, fire hose connections that have not been operationally verified within meaningful intervals.

Tank-receipt procedural compliance

Tank-receipt operations — the offloading of road tankers into outlet underground tanks — represent the highest-consequence operational activity at any fuel outlet. Procedural compliance during tank receipt requires substantive discipline: ignition-source elimination, area cordoning, dipping and reconciliation, grounding verification. Audits surface that procedural compliance during tank receipt varies substantially by outlet and by personnel — and that the compounding of small procedural shortcuts over thousands of receipts represents one of the sector's most consequential latent risk categories.

Trends and forward indicators

The technology transition

The fuel-retail estate is in mid-transition across multiple technology dimensions: EV charging integration at outlets; LPG and CNG dispensing additions; the early stages of hydrogen-dispensing pilots in some networks; digital point-of-sale and customer-experience technology overlays. Each transition introduces operational complexity that the legacy safety governance framework was not designed for. The technology overlays are running ahead of the safety-governance overlays in some cases.

Workforce evolution

Outlet staffing is becoming more transient. Younger workforce demographics, more flexible employment arrangements, and higher turnover rates produce a workforce environment where institutional safety memory at outlet level is shorter than it used to be. Training programmes that worked for stable workforces produce thinner safety culture in higher-turnover environments — and the training infrastructure has not uniformly adapted.

Independent assurance expansion

The most positive trend across the sector is the expansion of independent third-party assurance. All three PSU majors now operate with some form of independent assurance overlay, at scopes and cadences that have grown substantially over the past decade. Private-sector operators and joint-venture networks are following the same trajectory at varying pace. Where independent assurance is substantive and sustained, operating-stage compliance is materially higher than where it is absent or episodic.

Recommendations for the sector

For corporate safety functions

The corporate safety function in any fuel-retail major operates with limited inspection capacity relative to the network it must oversee. The recommendation is to focus internal capacity on the highest-leverage activities — corporate standard development and revision, training programme architecture, incident investigation depth — and to commission substantive, sustained independent assurance for the network-scale verification work.

Where independent assurance is in place, attention to the four operating disciplines (scope, methodology, closure, governance) is what determines whether the assurance produces operational improvement or just reports. The discipline checklist is the same one set out in the combined practice's public material on multi-site EHS audit programme design.

For regulators

Regulatory inspection at PESO and OISD level is necessarily focused on subset issues; comprehensive network-scale inspection is not the regulator's operational capacity. The regulatory framework is most effective when it requires operators to maintain substantive independent assurance overlays and treats the operator's ability to evidence sustained compliance verification as part of the licensing assessment. Some elements of this expectation are already implicit in PESO's inspection practice; making them more explicit would strengthen the framework.

For private-sector operators

The private-sector and joint-venture networks have grown substantially. They benefit from the PSU majors' investment in sector-wide standards and from PESO/OISD's framework architecture, but not all private-sector operators have built equivalent corporate-level safety governance. The recommendation is to invest in three layers: substantive corporate safety standards and SOPs; workforce training infrastructure that survives staff turnover; independent third-party assurance calibrated to the network's scale and risk profile.

Methodology note

The observations in this report are aggregated and anonymised from the combined practice's sustained engagement across the three Indian fuel-retail majors over more than a decade. Specific operator detail is not disclosed. The aggregated patterns reflect what the engagement teams have observed consistently across the sector; individual operator postures may vary in either direction from the aggregated picture.

The report is intended as a sector-level reference. Operator-specific or network-specific advisory work is provided through dedicated engagement. The combined practice does not publish operator-identifying observations except where the operator has cleared the disclosure for publication and the information is material to the sector picture.

About RAMC

Rapid Momentum Consulting is an institutional assurance practice for multinational organisations, built on a combined advisory and delivery network operating since 2007. The firm operates from a permanent presence in nine countries with approximately 268 professionals including around 24 senior practitioners. Distributed-asset safety governance is a core practice area, anchored by sustained engagement across the three Indian PSU fuel-retail majors and adjacent infrastructure sectors.