Separately Contracted, Same Deck: Governing Combined Subsea Operations

The configuration is common, and the contracts make it look tidy. An operator charters a vessel, and onto that same vessel it places a diving spread under one contractor and an ROV-and-survey spread under another. Three companies, three contracts – and every one of those contracts runs to the operator, not to the other two. The diving contractor is not bound to the ROV and survey contractor. Neither is bound to the vessel owner beyond the charter party. On paper it is a clean hub: the operator at the centre, three spokes out. On deck it is three crews who have, in many cases, never worked together, each answerable to the same client and to no one else aboard, sharing one set of cranes, one dynamic-positioning footprint and one column of water.

This article is about the space between those contracts, and about the machinery that has to fill it before anyone gets in the water. We write it for both sides: for the operator who has to architect and govern the combined operation, and for the contractor who has to work safely as a guest on another company’s vessel, alongside a peer it has no contract with. The honest position up front: the structure we describe – a single controlling authority, a properly built bridging document, a disciplined simultaneous-operations regime, and scopes of work written to interlock – closes most of the gap. It does not close all of it, and we will be specific about where it still leaks.

Why the missing contract is the load-bearing problem

Start with the geometry, because everything else follows from it. The operator holds a contract with each party. The parties hold no contract with each other. It is a hub with spokes and no rim. Every duty each contractor owes runs inward, to the client; none of it runs sideways, to the crew working two metres away under a different cap badge.

That has a consequence people underrate until they have lived it: each contractor, rationally, optimises for its own scope and its own client-facing performance, because that is the only thing its contract rewards and the only thing it is measured on. The seams between contractors – the handovers, the shared deck space, the shared water, the moments when one party’s operation constrains another’s – serve no one’s contract directly. They are nobody’s deliverable. So, absent an external authority whose remit is the whole rather than a part, the seams are exactly what gets neglected, and the seams are exactly where combined operations fail. This is not a matter of bad contractors. Independent, competent, well-run contractors produce this outcome by default, because independence is the design.

The clearest place this bites is the one nobody wants to rehearse: a casualty. Take a medical evacuation. If a person is injured on deck, the vessel – under its owner’s safety management system – is responsible for the immediate response on board and for getting that casualty off the vessel to a shore reception point, by helicopter or fast craft. But the vessel’s duty has an end. The leg from the shore point onward – definitive medical care, the hospital, repatriation, the ongoing duty of care to that individual – belongs to the injured person’s own employer, the contractor who put them there. That handover is real, it is consequential, and in our experience it is not always obvious and not always clearly owned in advance. Who calls it, where the responsibility passes, whose insurance and whose duty of care carries each leg – if that is not agreed and written before mobilisation, it gets argued over at the worst possible moment, about a person on a stretcher. And if the diving is saturation rather than air, the casualty may be under pressure and unflyable: the seam is no longer a stretcher to a helicopter but a hyperbaric evacuation – a chamber, a reception facility, a chain of custody that has to be owned before the bell ever runs. The missing contract does not announce itself in the calm. It announces itself in the emergency, at the seam.

The same logic runs through the whole emergency case, not just the handover of one casualty. A combined operation needs one emergency response plan, not three stapled together: a single muster with a live count of everyone on board across all three crews, alarms and stations that a guest crew actually knows, and a planned response to the operation’s worst credible events – a diver in difficulty, a lost-bell or hyperbaric emergency on a saturation spread, a man overboard during a transfer – that does not stall while three duty managers work out whose drill it is. The bridging document is where that single plan is supposed to live, and whether it actually does is one of the sharper tests of whether the document was built or merely signed.

Someone has to hold the ring

Because the contractors will not police each other – they have no standing to, and no contractual reason to – a combined operation needs an external party whose authority sits above all of them and whose remit is the operation as a whole. Without that, you do not get cooperation; you get three parallel operations sharing a hull, and that is chaos with good intentions.

That authority is the operator’s representative, and the key word is authority: it only works if the client has formally authorised that person to make operational decisions on board and to direct the contractors. There is more than one valid way to fill the role. The classic route is an independent third party – a company site representative engaged by the operator and empowered to take operational decisions and arbitrate between the contractors on the client’s behalf. The alternative is to mobilise the operator’s own staff member onto the vessel to run the combined operation and manage every contractor directly. Both work. The staffed-by-the-operator model can be highly effective where the operator has the in-house competence to carry it, because the authority and the client’s intent then sit in the same person; the independent-representative model brings neutrality and dedicated coordination experience. What does not work is leaving the role unfilled, or filling it with someone who has responsibility for the interfaces but no authority to enforce a decision across a contractor boundary.

This authority does not abolish the other command lines on the vessel; it has to sit correctly alongside them, and the seams between them must be understood by everyone. The vessel’s master retains overriding authority for the safety of the vessel and the prevention of pollution – that is not the operator representative’s to take, and under the ISM Code and SOLAS it cannot be. Where the work sits at or around a manned installation, a second marine authority enters the picture: the offshore installation manager holds the statutory authority for the installation and its surrounding zone, and the vessel’s master and the installation manager then have an authority interface of their own – one the operator’s representative has to broker, not blur. The diving supervisor holds the authority and the duty for the conduct of the diving operation and the safety of the divers – an authority grounded in law and the diving code rather than in any contract, which is precisely why no one’s commercial standing can override it; the ROV or survey supervisor holds the same for their spread. The operator’s representative coordinates and directs the combined operation and arbitrates the interfaces between these parties – but does not reach into a supervisor’s safety-critical decision about their own people. The structure only holds when each of these knows precisely where their authority begins and ends, who can stop the job (everyone), and who decides when and whether it restarts (not the same answer). Most of the ugly moments in combined operations are not equipment failures. They are two people each believing, in good faith, that a decision was theirs.

One precondition sits underneath all of this and is easy to take for granted: the vessel itself. It is the one asset all three parties share, and before it is accepted as the platform for a combined operation the operator has to have assured it as a vessel – its marine condition through an OVID or IMCA eCMID inspection, the scheme depending on the operator and the vessel, and, because divers and an ROV will be working under it while it holds station, its dynamic-positioning capability through a current DP class – normally DP2 as the floor for diving – a proven DP-FMEA and current DP trials. The charter then shapes the command web as much as the assurance does: under the common time charter the owner provides the master and the marine crew, so the master answers to the owner rather than to the operator, which is precisely why the operator’s authority over the vessel has to run as coordination, not command. A combined operation built on a vessel nobody independently assured, on terms nobody mapped to the command structure, has a hole at its centre before anyone mobilises.

The bridging document: built together, or it is theatre

The artefact that is supposed to reconcile all of this is the bridging document – the combined-operations procedure that takes each party’s safety management system, procedures, permit-to-work, emergency response and stop-work arrangements and welds them into one set of rules for the shared operation. In practice that means resolving the things that cannot be allowed to differ between cap badges: a single combined permit-to-work system, with one permit authority and cross-contractor isolations – including the lock-out of thrusters and other energy sources that protect a diver in the water; one set of life-saving rules – the operator’s, typically built on the IOGP Life-Saving Rules – that binds everyone aboard regardless of employer; a common working language for safety-critical communication, so a toolbox talk and a radio call carry the same meaning to every crew; and a deliberate cross-acceptance of each contractor’s competence-assurance scheme, so the operation runs on one standard of who is qualified to do what rather than three. The concept is sound and it is expected good practice; the ISM Code’s own requirement to define responsibilities and interfaces points straight at it. The problem is almost never the concept. It is how the document is produced.

A bridging document only works if it is developed jointly, by every party to the operation, and developed well before mobilisation. In our experience the way to do that is through several iterations and face-to-face workshops, in which each party puts its own operation on the table, states its own risks, and reconciles them against the others’ – because only the diving contractor truly knows its diving risk, and only the survey contractor truly knows where an ROV in the water will be. A document built that way carries the assumptions of everyone who will have to live by it. The failure mode is the opposite, and it is depressingly common: the document is drafted by one party, in isolation, and put in front of the others to sign; the others, busy and assuming it is boilerplate, do not give it the attention it needs; and everyone discovers at the worksite that it was written around one party’s operation and does not actually describe how the combined job will run. After that, the chaos is real, and it is now governed by a binder nobody believes in.

There is a second discipline that gets skipped and should not be: every person on the operation must be taken through the bridging document and must acknowledge it, by signature. A document that the project managers negotiated but the deck crews never read is not a control; it is evidence collected for after the incident. And it has to reach down into the artefacts that actually run the day – the dive plan, the task risk assessments, the toolbox talks – because that is where the combined plan is either executed or quietly diverged from. The test of a real bridging document is simple and unforgiving – built by all of them, argued over in the room before anyone sailed, and signed off by everyone who has to act on it.

Simultaneous operations: where the seams meet the water

Everything above is abstract until two operations run at once, and then it is not abstract at all. Simultaneous operations – SIMOPS – are where the absence of a contract between the parties stops being a commercial nicety and becomes a question of whether someone surfaces. The combinations are familiar: a diver in the water while the vessel is on dynamic positioning; an ROV and a diver in the same body of water at the same time; a crane lift over or near the dive. They also include the activities people forget to count because they are not the subsea job at all – bunkering, a helicopter on deck, supply or personnel transfer alongside, cargo work running while subsea work continues below. Each is a combination that one contractor cannot make safe on its own, because the hazard is created by the other party’s activity, and the recognised reference for managing them as a set is IMCA M 203, the guidance on simultaneous operations.

The control is a SIMOPS regime that is explicit about what may and may not run concurrently. In practice that is an activity-against-activity matrix – every operation on one axis, every other on the other, each intersection marked permitted, permitted-with-controls, or prohibited – backed by physical exclusion zones, defined communications between the supervisors, and unambiguous abort criteria agreed in advance. A matrix is only as good as the controls written behind each cell, and the controls are where the individual codes earn their place.

Take the cases in turn. Diving while the vessel is on DP is the archetype, and it is closely codified: IMCA D 010 governs diving operations from vessels operating in dynamically positioned mode, setting out the DP set-up, the alert-status system, the vessel-movement limitations and the loss-of-position responses that keep a diver clear of a thruster intake when position degrades – with management of the diver’s umbilical, the thing that is actually drawn toward a thruster, now carried in the companion guidance IMCA D 078. The diver-and-ROV case has its own dedicated reference, IMCA R 005, on remotely operated vehicle intervention during diving operations; it turns on water-space deconfliction, umbilical and tether management, and a single agreed picture of who is where before either goes in. The crane lift over the dive is a lifting operation in its own right under IMCA M 187, and a lift in the same water as a diver is exactly the kind of intersection the matrix exists to prohibit or tightly control. And where a lift or other marine operation falls within a marine-warranty scope, a separate gate appears alongside the matrix rather than inside it: the marine warranty surveyor, insurer-appointed and outside all three contracts, whose approval is a condition of the work rather than a SIMOPS control of it. Underneath all of them sits the combined permit-to-work system and the physical isolations it commands – the thruster and energy lock-outs that turn an agreed rule into a state the equipment is actually in.

None of it works without the layer above the matrix: a stop-work authority that genuinely crosses the contractor boundary, so the ROV supervisor can stop a lift that endangers a diver who is not their employee, and a single coordinating authority who holds the combined plan and adjudicates when two supervisors read the same situation differently. The individual codes – IMCA D 014 for the diving, the ROV and DP guidance for the rest, each party’s competence scheme for its own people – give every contractor its own rulebook. What no single code resolves is the points where those rulebooks touch. Making them consistent there is the work of the bridging document and the SIMOPS matrix, and it is the whole reason both exist.

None of this is built once and left alone. The plan is agreed before mobilisation; the job then changes – weather closes a window, a scope grows, a thruster or a compressor goes down – and every change reopens the matrix. So the combined operation needs a management-of-change discipline that crosses the contractor boundary as well: a change that suits one contractor’s schedule can quietly load risk onto another’s, and the party that benefits is rarely the party that carries it. The authority to approve a change to the SIMOPS matrix or the bridging document has to sit with the same coordinating authority that holds the combined plan, not with whichever contractor wants the change – otherwise the controls drift apart in service, one convenient deviation at a time.

Roles, responsibilities, and the scope-of-work stitch

The durable way to close the seams is upstream of the vessel, in the contracts themselves – and this is where careful drafting earns its keep. Each party’s scope of work has to be written not only to define what that contractor delivers, but to define the interface: what it provides to and receives from the others, who owns each shared resource and each shared risk, and – explicitly – who owns each leg of the emergency response, including the casualty handover described earlier. The interfaces that fall between scopes are the ones that hurt; the remedy is to make sure no safety-relevant interface falls between scopes, by writing it into one of them on purpose. We have always treated the composition of the service contract as a safety document in its own right, not only a commercial one, because the scope of work is where an interface either has an owner or does not.

The liability geometry has to be deliberate for the same reason. Because the contractors have no contract with each other, the mechanism that protects them from each other is the mutual hold-harmless – knock-for-knock – written into each contract with the operator. Constructed properly, each contractor indemnifies the operator’s contractual group – the “Company Group”, drafted wide enough to bring in the operator’s other contractors as indemnified parties – for its own people and property regardless of fault; run consistently across every contract in the spread, this propagates a web of cross-indemnities that substitutes, imperfectly, for the direct contract the parties do not have. It is what stops an incident between two co-located contractors becoming litigation between strangers. It only works if every contract in the operation is built on the same regime and the group definitions actually interlock; a single party contracted on different liability terms, or a Company Group that quietly fails to name the others, is a hole in the net, and finding that hole after an incident is not the time.

And the bridging document binds all of it together on the operational side: it is the instrument that regulates the relationship between the parties in the areas of safety, the conduct of the work, and protection of the environment – the operational counterpart to what the scopes of work and the indemnity regime do contractually. Some operators go a step further and manufacture a direct link the default structure withholds – a multi-party simultaneous-operations agreement, or a bridging document given contractual force and countersigned by every party – which turns part of the missing rim into something enforceable between the contractors rather than only through the hub. It is more work to put in place; where the risk justifies it, it is the most honest answer to the gap.

What the structure cannot close

We said at the start we would be honest about the residue, so here it is. A single authorised authority, a jointly built and signed bridging document, a disciplined SIMOPS regime and interlocking scopes with a consistent indemnity web will close most of the gap left by the missing contract. They will not close all of it, and pretending otherwise is its own hazard.

The independence that creates the problem does not go away; it is the commercial design, and on a long or pressured job the parties’ priorities will still pull apart at the edges. A bridging document is only as live as the last time people acted from it; left unrehearsed, it decays into a binder, and the decay is invisible until it is tested. The command structure is sound, but a seam between authorities is still a seam, and the moments where it is contested are exactly the high-tempo moments when there is no time to debate it. The cross-boundary stop-work authority has the same gap between paper and practice: a junior hand on one contractor’s payroll has every right to halt another contractor’s operation and, in the moment, will often hesitate to – the right is granted on the page, but the gradient of rank and employer is real, and closing it is a matter of culture and drills, not clauses. The casualty handover can be written down perfectly and still be fumbled in the first ten minutes of a real emergency, because the people executing it have never had to. And no indemnity regime reaches every party in every circumstance – third parties, gross negligence, the boundary between the vessel’s marine risk and the contractors’ subsea risk – so some exposure always remains where goodwill, not paper, is carrying the load.

None of that is an argument against building the structure. It is an argument for building it fully: staff the authority for real, make the bridging document the product of everyone who will live by it, write the interfaces into the scopes on purpose, and then treat the residual seams not as solved but as the things the operator’s representative and the supervisors watch hardest, every day, for the length of the job. A direct contract between the contractors usually never exists. Everything here is the work of standing in for the one that does not.