The Chair and deputy Chair of the IRMs Energy Special Interest Group (SIG), Alexander Larsen and Grant Griffiths review the role of risk management within the Energy Industry and discuss their observations and recommendations. The SIG has created a committee which is not just limited to oil and gas but encompasses other parts of the industry including renewables and nuclear.
Energy is vital to everything we do, it powers cars, homes and businesses. There are approximately 7 billion people in the world and astonishingly, almost 1 billion of those still don’t have access to electricity, prominently from developing nations. Therefore there is still huge amount of work to do to get electricity to everyone in these regions.
There is an ongoing transition in the energy industry taking place around the world moving from the oil and gas sectors to the use of renewables and electricity. Several challenges are facing the industry, due to the growth in population and the corresponding increase in demand.
With the ever increasing threat from climate change, there is a requirement to do the right thing for the environment. In addition to decarbonisation there is also new technology and digitisation transforming the industry.
“There is a drive towards doing the right thing for the environment, all stakeholders and investors in the industry”
Grant Griffiths, Deputy Chair of IRM Energy SIG
Risk management is at the heart of the decision making and strategy within the energy industry. The IRM SIG prepare research and publication discussing risk management in the energy industry and how well it is embedded and understood.
As 2020 has presented unprecedented challenges with Covid-19 there has also been challenges with OPEC and the global oil and gas prices. There are changes in global supply chain, transition in energy and diversification of energy supply.
A lot of these risks present as threats but can they can also be opportunities. Resilient and flexible organisations have been able to react to the pandemic by adapting their business models and quickly mobilising their workforce to be home based while continuing operations.
Risk Management needs to be embedded throughout the organisation to help key decision makers an ensure there is a positive risk culture. Staff need to be trained at all levels so when they see a risk they know who to report it to and how. Ultimately risk and resilience training can decrease the threats risk presents and increase opportunities.
“Staff are a critical component of successful risk management.”
Alexander Larsen, Chair of IRM Energy SIG
The IRM offers training to all levels of an organisation and courses are put together by risk practitioners and industry experts. Looking to the future, risk techniques such as horizon scanning and scenario testing will help an organisation be prepared for any possible event. Risk awareness and embedding risk processes will determine how successful an organisation will be in driving strategic decisions in the energy industry.
As Chair of the Energy Special Interest Group for the IRM, Alexander Larsen was asked to provide an overview of the role of risk management within the Energy sector in the current climate.
Risk management is a part of every aspect within the Energy industry; operations, production, safety or related to projects and decision making, schedules and budget.
From a strategic point of view for the Energy sector, there is a consideration for entering the renewables market. Is this the right move?
Entering into the renewable market may result from buying another organisation or merging. Need to consider whether the organisations are compatible with their business models and ensure the right investments and technology.
Risk Management is a key part to all these strategic decisions. Therefore, it’s important that sufficient training is provided, not just to Risk Managers but the board, executives and all key decision makers.
The IRM offer courses to all levels of an organisation and training is put together by risk practitioners and industry experts.
With the devastating effect of Covid-19, organisations and economies are suffering more than ever around the world. Risk Management plays a vital role in creating agile resilient organisations and now is the time to think about the future.
What can we do to prepare for another pandemic?
How will we cope with another lockdown?
How can we support our employees and customers?
To be prepared for any incident and make risk-based decisions, an effective risk and resilient framework is key. Organisations must assess emerging risks and face a post Covid world where more technology and less face to face interaction will become the new business norm.
Dr Mark Vine has over thirty years experience as an HSE Manager and Management Consultant with extensive experience in oil and gas, chemicals, government, transport, insurance, NGO’s and development banks. His experience covers the full lifecycle from mega and major projects through to operations.
Mark is a recognised subject matter expert in HSE MS and Operations Management Systems (OMS) development, implementation and assurance with a focus on sustainability, Environmental and Social Governance (ESG), process safety, behavioural based safety, asset integrity management and Operational Excellence (OE).
LR Consultants is a unique boutique consultancy that provides high value management consulting services to the global energy, chemical process, mining, banking and financial service industries.
LR Consultants is headquartered in Dubai, United Arab Emirates and is supported by an extensive global network of highly experienced independent consultants with executive and senior management industry experience in capital projects delivery and operational excellence.
1 OVERVIEW
As a business leader or senior manager it is natural that you should be continually asking questions that challenge to improve the performance of your business management system.
LR Consultants experience suggests that the following questions reflect the foremost concerns of business leaders:
Are you increasingly frustrated that your projects or business strategy is failing to deliver expected and timely results to your key performance indicators?
Is your projects or business management system overly complex, costly to operate and/or experiencing low recognition and involvement amongst your workforce?
In a rapidly changing business world is your projects or business management system not proving to be resilient and is it unable able to respond effectively to market changes and emerging risks?
Is your project or business management system unsuitable to deliver compliance to the Environmental Social and Governance (ESG) expectations of donor financing institutes who follow IFC Equator Principles and World Bank requirements?
If the answer to any of these questions is affirmative then the solution should be to invest in Operational Excellence.
This LR Article provides the basics to Operational Excellence (OE) and how to achieve the benefits through the transformation to an enterprise wide Operating Management System (OMS).
2 WHAT IS OPERATIONAL EXCELLENCE?
There is no unique internationally accepted definition of OE. Some of the more well known definitions are provided in Table 1.
“Operational Excellence achieves and sustains outstanding levels of performance that meet or exceed the expectations of all their stakeholders”
OE is not the same as Continuous Improvement (CI) which has been promulgated by the ISO suite of management system standards. A comparison of the LR Consultants OE cycle against the ISO CI cycle is provided in Figure 1.
Figure 1 LR Operational Excellence and ISO Continuous Improvement Cycles Compared
A CI business is one that follows a process of improve, sustain, measure and monitor. The business then repeats the cycle over and over again to create a culture of CI. A significant downside is that CI often has no goal or destination to meet and it can be a slow and unreliable journey to deliver results.
OE delivers integrated performance across revenue, cost, and risk. Conversely to CI, it focuses on meeting operating and stakeholder driven results through the CI of the operational processes and culture of the organisation.
The goal of OE is to develop one single, integrated enterprise wide management system with a strategic results and stakeholder based direction, driving visualised risk optimised business processes and workflows. The second component of OE, a culture of Operating Discipline, is commonly described as “doing the right thing, the right way, every time”. According to BTOES this Operating Culture is built upon the guiding principles of leadership, integrity, questioning attitude, always problem solving, daily CI mind set, level of knowledge, teamwork and influencing workforce behaviours.
An OE organisation is more agile and able to identify and manage emerging threats and to rapidly transform itself than its CI counterpart. OE organisations are inherently more resilient and adaptable to changes to stakeholder concerns and market conditions.
These relationships can be visualised using the LR Model for OE shown in Figure 2. The LR Model (under development) is designed for high risk or safety critical industries (oil and gas, power, chemicals, pharmaceuticals, transport, mining and nuclear) and to meet the requirements of sustainability. It is fully compliant with IFC Equator Principles and ESG requirements.
The LR OE Model delivers ISO compliance as a minimum requirement and has Plan-Do-Check-Act (PDCA) as an integral part of its DNA. It delivers sustainable business results and can be applied across the cradle to grave to rebirth business lifecycle.
Figure 2 LR Risk Optimised Model for Operational Excellence
Figure 2 depicts “Risks” as a separate element associated with business process controls. In reality “Risks” are distributed and embedded in all elements of the LR model. Risk management is critical to ensuring that business strategy and processes are optimised and prioritised towards meeting key performance indicators. Emerging risks require timely management and worker adaptation of existing business or operating processes in order to ensure that the business remains resilient to changing market conditions and aligned with any adjustment to business strategy.
OE has been formally defined by the European Foundation for Quality Management (EFQM) through their EFQM Model for OE shown in Figure 3.
Figure 3 EFQM Model for Operational Excellence (EFQM, 2018)
The EFQM Model is a globally recognised management framework which allows organisations to achieve success by measuring where they are on the path towards transformation, helping them understand the gaps and possible solutions available, and empowering them to progress and significantly improve their organisation’s performance.
Both the LR Consultants and EFQM Models for OE can both be used in enterprise wide management system design, implementation, benchmarking and transformation for immature and mature businesses alike.
A key difference between the LR and EFQM approaches is that the LR OE Model has been designed for safety critical industries and is able to distribute risk criticality through all elements and processes of the model. Risk optimised business processes are shaped and prioritised by the critical findings of the enabling risk assessment. This is a key reason why ISO management systems create the risk silos and traditionally fail to manage systemic process safety and asset integrity risks.
3 FUNDAMENTAL CONCEPTS AND THEMES FOR OPERATIONAL EXCELLENCE
The fundamental concepts of OE (shown in Figure 2) outline the essential foundation for achieving sustainable excellence for any organisation. The concepts can be used as the basis to describe the attributes of an excellent organisational culture. They can also serve as a common language for senior management.
OE covers a number of risk themes (with a focus on risk reduction results) that should be assessed and managed for all projects, facilities, activities, products and services for which your business is partially or wholly responsible or accountable. An illustration of the OE risk themes typically used in capital intensive safety critical industries is provided in Figure 5.
4 OPERATIONAL EXCELLENCE AND OPERATING MANAGEMENT SYSTEMS (OMS)
OE Models can be used to design, develop, benchmark and transform the enterprise wide management system.
Many organisations are commercially driven to satisfy the disparate needs of the many ISO management system standards often creating overly complex, inefficient and costly to operate management systems. ISO driven management systems, particularly in the case of safety critical industries fall far short in managing process safety and asset integrity risks.
The solution to efficient and effective OE delivery is to develop an Operating Management System (OMS), also referred to as an Integrated Management System (IMS). The term OMS is preferred in this Article.
An OMS is a complete framework that combines all aspects of an organisation’s systems, processes, and any standards that the business follows.
An OMS is used for controlling risk, delivering high performance and achieving Operational Excellence.
“Operating” applies to every type of company activity, including concept design, engineering, construction, commissioning, operations, inspection, maintenance and decommissioning, throughout the entire value chain and lifecycle of the business and its products.
The development of an OMS that incorporates Equator Principles and ESG requirements fully satisfies the project financing requirements of donor Banks and External Credit Agencies.
An illustration of an OMS framework created from the integration of individual ISO and non-ISO management systems is provided in Figure 6. An important part of integration is to upgrade the minimum requirements of ISO based management systems to incorporate industry best practice.
Figure 6 Integration of Individual Management Systems into an OMS
5 WHAT ARE THE BENEFITS OF OMS AND OE?
The benefits of OMS and OE investment to your business are summarised in Table 2.
Table 2 Summary of OMS and Operational Excellence Benefits
Written by Alexander LarsenCFIRM, IRM Energy SIG Chair & Ghislain Giroux Dufort MIRM, both of Baldwin Global
The Institute of Risk Management recently released a thought leadership document based on a survey of the Energy industry. As part of the survey results, there were a number of articles contributed and featuring in the final report.
This was one of the featured articles. To download your own copy of the publication, please CLICK HERE for the IRM site
How much appetite for risk does your organisation have to achieve objectives or seek new challenges? Are staff and managers aware? are the senior management team or board even aware? Is the organisation ready to reach for the stars?
Some organisations operate in high risk environments (think SpaceX, Virgin galactic and NASA) whilst other less so. No matter the industry however, establishing risk appetite and tolerance levels (and monitoring over time the actual risk profile against them) is essential to the long-term success of any organisation, whether in the energy industry or other sector of activity.
When discussing risk appetite, people tend to think of bland and non-informative risk appetite statements, or overly quantified and financial risk appetites. Both of these have limited value and often restrict risk taking rather than allow risk taking. In many cases space travel, air travel or other high risk activity should not be possible according to risk appetite statements. How can we expect to achieve great things and remain competitive with such appetite statements?
Looking at the high-level risk appetite statements, they are nearly always:
A) Too broad to gain any significant use out of the statement
How can decisions realistically be made from a statement such as we “will not accept any risk that affects our reputation”?
B) Rehashes of the corporate objectives or taken from other targets such as HSE accident rates
An organisation could have endless risk appetite statements that would allow no risks to be taken if this was the case.
C) Inconsistent with objectives
How can an energy company operate in an environment where a risk appetite statement says “we will not accept project delays of x” or “we will
not accept loss of life.” The nature of the business is projects and delays, while operating in countries such as Iraq or Afghanistan goes against “we will not accept loss of life”. The statements are too broad and lack detail or real decision-making value.
D) Never change
Once an organisation sets a risk appetite statement, they rarely change, and why would they? It’s a very high-level statement that can only be written in a small number of ways.
E) Don’t consider the risks
The risk appetite statements we have seen are almost exclusively linked to objectives, which doesn’t take into account the actual risks or opportunities that the organisation faces.
Most organisations struggle with putting together even the high-level type of risk appetite statements. They often spend a lot of time and resources on trying to perfect high-level statements that don’t provide much decision- making value, or on overcomplicating the statements, which again leads risk appetite to being ineffective.
In this article we highlight a methodology that provides decision-making value to quantified risk appetite statements by linking corporate objectives to leading key risk indicators (KRIs) established at the source of risks that may affect the achievement of those objectives. This approach provides a warning system that increases the chance that organisations may take action before risks materialize as well as ensuring that organisations are not spending too much money over controlling risks. In other words, allowing them to take more opportunity or spend the money more wisely elsewhere!
Objectives v risk
While the whole point of risk management is to identify and manage risks to the objectives, risk appetite statements tend to focus solely on objectives, for example aspirations of zero accidents or deaths. Risk appetite therefore ends up driving risk identification rather than the risks driving the risk appetite.
Assume an organisation has 5 key objectives, and 5 major risks. Once targets and acceptable deviations relative to targets have been set for key objectives, how does
the organisation manage to minimize the chances of deviating from key objectives? The answer is to focus on the major risks to key objectives and to set risk appetite statements for these risks rather than only on objectives. Assuming that risks change more often than objectives, we can also expect the appetite statements to change more frequently too.
One other major benefit of linking appetite to risk is that we can actually map the risk through to the relevant key risk indicators (KRIs) with individual risk appetite ranges for each KRI as shown in Figure 1 overleaf.
Figure 1: Baldwin Global’s Key Risk Indicator and Risk Appetite Model
How to set risk appetite and key risk indicators in your organisation
In our experience, high-level risk appetite statements based on each major risk can be put together in a half-day workshop with management teams. Detailed quantified risk appetite statements based on KRIs established at the source of risks will require some
more time depending on the nature of the risk and availability of data and expert opinion. It is important to run workshops rather than setting these statements in isolation. Not only does it ensure everyone is aware of the risk appetites, but there is the added benefit of increasing risk knowledge and building a positive risk culture while also gaining a variety of views and experiences to develop the appetite statements.
Of course, when setting statements, it is important to consider the wider implications for the organisation. Rather than setting a figure for what is acceptable in terms of accidents or deaths for example, AirSafeCo, the fictitious airline company example below in Figure 2, decided to look at improvements to long term trends and focus on not accepting an increase in the trend. This presents a more sensitive approach to safety risk and its management over time, rather than having an “acceptable” number of casualties or fatalities.
In addition to the general risk appetite statement written in Figure 2, more specific and quantified statements should be established based on leading key risk indicators linked as closely as possible to the source of the risk. Figure 3 illustrates such a statement for AirSafeCo’s three top components of Safety Risk: Crash, Turbulence and Tarmac delays.
Figure 2: AirSafeCo’s General Risk Appetite Statement
Figure 3: Examples of KRIs and how to build a risk appetite linked to them
The Green Zone represents the quantified risk appetite for each risk component: the amount of risk the company is willing to accept in order to achieve its objectives.
The Orange Zone represents the first level of tolerance and may require, for example, an investigation into the reasons for this deviation. The Red Zone represents the highest level of tolerance where immediate action is required. More risk tolerance zones may be inserted to provide various levels of analysis and/or action. Leading KRIs of crashes might be, for example, near miss events. In turn, one could then search for leading indicators of near miss events, and so on. Each industry and company should find or create leading KRIs that are causally correlated to their key risks and linked to their impact on corporate objectives.
Risk workshops may provide expert opinion on KRIs and appetite and tolerance levels. But having the right data to validate those opinions is essential too, and it is therefore important to understand what the components and causes of risks are, in order to understand what information is required. As an example, for an oil & gas facility in a sensitive area, the risk of “major loss of life” could come from a terrorist attack, major accident or natural disaster. Once you have identified the components and causes of major risks, KRIs can be established which allow individual risk appetites set at their source.
Also note that Figure 3 is two-sided: the right side indicates positions of increasing risks, while the left side indicates positions of reducing risks – but at an increasing cost. Since risk management is not free, trade-offs may have to be made when deciding on risk appetite and tolerance, and the cost of managing a risk to its appetite and tolerance can also be monitored using this approach.
How does this help decision-making and risk reporting?
One of the roles of risk management is to enable boards of directors and senior management to make better strategic decisions. Too often, organisations limit themselves to reporting risks independently, through risk registers and heat maps. This is very limiting and often out of date. Additionally, risks rarely change significantly which means the top 3 or 4 risks (in terms of likelihood and impact) are discussed at length whilst the others get missed. What should be done is to integrate risk assessment and reporting within business cases for decision making purposes.
Figure 4: Example of Risk Reporting based on Appetite
As we have seen earlier, risk visualisation is a far more effective method of viewing risks for decision-makers, offering an alternative view of what the top risks might be. The approach to risk appetite and KRIs that we have so far discussed offers yet another alternative to the traditional risk register approach to reporting. It provides real-time snapshots of the status of risks to the business and a perspective on their trends. The top three to four risks on most risk registers are usually very well managed, and senior management would be better off discussing the other risks that might be less well managed. A visually effective reporting template allows for such focus on relevant risks and is demonstrated in Figure 4 above.
Looking at the reporting example in Figure 4, the output from the KRIs and the related risk appetites shows clearly which risks are most pressing. Senior Management and the Board would be able to tell quickly which risks are within their appetite and which ones lie outside their appetite or tolerance levels. A focus on the last five quarters of Safety risk shows that KRIs have gradually improved over time towards the Green Zone, a sign that enhanced safety risk management has paid off in this example.
Conclusion
Whether they operate in the field of transportation, energy, or any other sector, including not-for-profit ones, organisations need to take risks in order to achieve their objectives and to thrive.
In the words of Sir Richard Branson, “Unless you risk something, the world stands still”, something which his Virgin brand always seeks to do (Changing the world) from space travel to hyper look and hyperspeed travel to greener air travel. “We take a lot of calculated risk, but we make sure that no one risk is going to topple everything. Protecting the downside is critical”
Where risk appetites and tolerances have already been determined, it is counterproductive to be over-managing risks. One of the unique aspects of this approach to risk management and reporting, aside from focusing on risks that really need attention, is that it also exposes risks which may have too many controls and where resources would be better spent elsewhere.
Over 150 risk managers, insurance professionals and CEO’s attended the impressive Four Seasons Hotel in Jumeirah Beach, Dubai, for the 2016 Middle East and Africa Risk & Insurance Awards held by Strategic Risk & Global Reinsurance Magazine.
I had personally only attended a couple of Awards Ceremonies over the years and never as a nominee for an award. Lukoil, who I was respresenting, had gone all out by reserving what ended up being a full table of Lukoil executives and managers. Feedback was positive from organisers too suggesting that the attendees had brought a level of enthusiasm and support rarely seen at awards ceremonies.
I have to thank my colleageus for their genuine and enthusiastic support and top management for reserving the table in the first place.
It was a fantastically successful night for Lukoil who were nominated in 2 categories, Risk Communication Strategy of the year & Risk Manager of the year, something that only a handful of other companies managed to accomplish. Even more impressive was the fact that Lukoil won awards in both categories they were nominated for! No other company succeeded in winning more than one award making it a fantastic evening for the oil and gas company who has been pushing ahead with Risk Management despite pressures in the market and with other oil giants cutting their staff in the thousands.
A special mention to Qatar Foundation who have been nominated a few years in a row now for various awards and who i feel a strong affiliation with having helped develop the Risk Management program a few years ago. The risk department have done an excellent job in pushing forward with Risk Management and championing it across the organisation whilst developing it further and continuing to increase risk maturity!
For me personally, its been a tough couple of years here in Iraq. Working in isolation, in a difficult environment, on a shift basis and in a dangerous environment. Its been stressful and challenging but the award has made my effort and time well worth the while and I have to thank Lukoil for the ongoing support of risk management, my colleagues for supporting the process and always being transparent and honest when identifying risk and helping me understand very technical aspects of oil and gas.
This award is a highlight of my career and I look forward to continuing to add value to the risk management professsion anyway I can.
Entering into any new country requires a solid understanding of Legislation and customs processes. Unfortunately in a country which is still evolving, legislation can change often and through different communication channels which might not be picked up by the company. Additionally, suppliers and contractors working with the company will certainly not be aware of any paperwork requirements. These are just some of the issues.
Suppliers and contractors Lack of experience with Legislation & customs
1.Risk that customs clearance not considered properly in project schedule
When building a schedule for a project in Iraq, contractors and schedulers will often put a set amount of days in the schedule for delivery to site of equipment. Often customs clearance is not even a consideration and they only take a figure based on regional experience. Even if they include customs clearance as a specific activity, very often they will only assign a week or in some cases a maximum of 2 weeks for customs clearance. Experience has shown that customs clearance actually rarely takes 2 weeks, and that is a best case scenario. A month was a more realistic number and should be accounted for in schedules.
2. Risk that mobilization not considered properly in project schedule
As in the previous risk, this is schedule related. Too often unrealistic targets are set in terms of mobilization. 3 months is a common figure in schedules. This might be possible in other countries but in Iraq it certainly isn’t. From issues with visa’s to issues with getting equipment to site in order to start building for mobilization, it all leads to a more realistic mobilization time of about 5-6 months. If you get this wrong from the outset then you are already facing a large delay in your project which may be difficult to recover from.
3. Risks of incorrect documentation or incorrect translations for equipment
A risk that occurred frequently in Iraq was that contractors would often have incorrect documentation for customs clearance. There are a variety of requirements that contractors or vendors who have never worked in the country will not know about. Even if they do know about them, they may not be completely aware of the specific detail behind the requirements. There are additional issues such as translation that could be incorrect or from non-authorized entities which again can delay the process.
4. Risks of incorrect documentation or incorrect translations for visas
Like the previous risk, this is related to contractors or vendors not having the correct documentation or translation for visa’s. There have ongoing issues with visa issuances due to incorrect documentation provided by contractors. This is usually only during mobilization and once they overcome the initial hurdles they understand the requirements much better.
The Institute of Risk Management recently released a thought leadership document based on a survey of the Energy industry. As part of the survey results, there were a number of articles contributed and featuring in the final report.
A Guide to Risk Management 