When Tony Hayward took over as Group CEO of BP in May of 2007, he acknowledged BP’s past failings and promised to correct them. He continued plans to make $7 billion in safety improvements. He took personal charge of BP’s group operations risk committee. He expanded the safety audit group and increased safety training.

Much good it did BP or him. When BP’s Macondo well blew, eleven men died, and in the aftermath as much as 7.8 million barrels of oil spewed into the Gulf of Mexico. The disaster will cost BP $32 billion by its own estimate. Hayward lost his job as CEO.

How could this happen? Where did he go wrong? What were the warning signs of problems in risk management at BP?

Hayward brought BP’s accident rate from the worst of the big three oil companies in 2007 to the best in 2009. But there were signs of deep troubles beneath the statistical surface. In 2009, U.S. safety regulators assessed the largest safety fine in U.S. history against BP for “willful and egregious” violations of safety controls and failure to fix hazards at the Texas City refinery dating back to 2005.

BP ended 2009 with the best net margins among the big three as well, but Hayward wanted more. As he said about his company’s results, “BP is performing okay now. We are back in the pack and doing fine. But there is still a gap between us and the best in the industry…So we think there is a long way to run in terms of overall efficiency that we can drive into BP.”

There were strong incentives for Hayward to think that way. Under BP’s bonus plan, top executives received no share awards unless BP ranked at least third place among the oil majors. BP finished last in shareholder returns for 2005 – 2007, and Hayward failed to get a share bonus in 2007.

BP took great pride in being a leader in deepwater drilling. As its head of exploration and production put it, “We don’t do simple things. We are prepared to work at the frontier and manage the risks.” Yet Thunder Horse, the company’s showcase deep field in the Gulf, was delayed for years by a flood of blunders, including faulty welds and improperly installed valves.

Whatever gains BP made against risk at the top, they did not penetrate down to the deepest levels of the company, where simple safety violations get corrected and basic quality checks take place. The pressure to keep up with Exxon and the rest of the majors meant line managers at BP had to make trade-offs between key measures like accident rates and new reserves and “overall efficiency.” They made them poorly at Texas City and Thunder Horse and disastrously at Macondo.

The risk management lesson? It’s hard to make deep, company-wide changes in risk management. It takes more than just a few years. It’s an even harder and longer job when incentives focus on returns and ignore risk.