The fire left one worker with burns to an arm and hand.
A direction is more serious than a notice. This comes after a series of directions issued for the state of some of its platforms, which the regulator requires it to decommission within seven years.
The platforms are part of the wider historic Gippsland Basin Joint Venture operator Exxon shares with BHP. Woodside will take over when its acquistion of the latter's patroleum completes next year, subject to shareholder approval.
Kingfish B was shutin three years ago and Exxon begund decom work early this year. The platform was briefly home to a lost flying fox some years ago, which workers apparently fed with fruit until he could be moved onshore.
Employees of contractor UGL were removing the closed pile pump string from the cassion when the vapour inside ignited, causing a three-second flash fire.
The National Offshore Petroleum Safety and Environmental Management Authority said the flash fire came after containment was broken on a closed drain skimmer pile, which was opened to replace the pile pump.
It said during its investigation there were "a number of failures" by Exxon to take reasonably practical steps to address the safety issues that caused the fire.
Workers did not bring up known safety issues, fearing they could lose their jobs, NOPSEMA's investigation found.
Exxon and UGL conducted an investigation and found there were varied issues which included work supervision, awareness and implementation of management systems,
and a "lack of reference to the existing safety case controls" that related to fire or explosions.
The company has told NOPSEMA it is also conducting a "Cold Eyes Safety Leadership Review... "to assess the offshore safety culture".
An Exxon spokesperson told Energy News it took safety seriously and paused work after what it described as a "small fire".
"Since the incident, we have worked hard to incorporate learnings and address any concerns the regulator or our workers may have, and Esso has already taken corrective actions, including equipment upgrades, enhancement of training procedures and increased interface with contract partners," the spokesperson told Energy News.
"We actively encourage our workforce to report any safety concerns without fear of retribution, so we can identify and prevent incidents before they occur and apply these learnings across all of our operations to ensure a safe workplace for all."
A UGL spokesperson said the company, which is owned by CIMIC, did not comment "on matters related to our people, however I note that health and safety in our work environments - including empowering our people to speak up - are paramount to everything we do".
NOPSEMA is not satisfied with this and has demanded it begin a third-party external review and provide all findings within 270 days given it has conclusively found a "series of failures" led to the fire, exacerbated by a workforce scared to air their concerns. A separate, independent review must be undertaken to address workforce concerns.
The safety regulator is also concerned more broadly on procedures for changing the kit, saying it is "generic in nature" and does not address the specific way it needs to be done on the Kingfish B platform.
It must now design works specific to platforms in all 13 blocks before breaking containment to work on another pile.
These three requirements make up the content of the directions.
The Australian Workers Union and UGL could not be reached for comment.
In a case not dissimilar, the regulator was investigating two incidents at Jadestone Energy's Montara platform offshore Western Australia early last month, one of which also resulted in a worker sustaining burns.
Jadestone was later issued a notice after a worker was medevaced from the platform with a rolled ankle. At the time unions alleged a poor safety culture which ignored worker concerns was responsible for the former incident.
The burned worker declined to go public for fear of possible retribution, unions said, but he is understood to be pursuing workers' compensation.
According to the union group the marine engineer was burned by a boiler when he was working alone, after reportedly suggesting it was unsafe to do so. Jadestone did not notify NOPSEMA as it said it was not required to given the burned worker was not helicoptered from the platform.
Jadestone did not receive a notice for the incident but NOPSEMA did publish a note on its website, which did not name the company, which said it expected to be notified of injuries.