Managing risk and uncertainty provides competitive advantage
Scott W. Randall, Boots & Coots, Houston
The current preoccupation with deepwater development risks and uncertainties has an interesting parallel to the global preoccupation with emerging risks in the broader world economy. In fact, the parallels are so strong that we could consider deepwater risks as a subset of emerging risks faced by companies and governments across the globe.
This article is aimed toward a petroleum industry audience, and I will draw primarily on upstream oil and gas examples. But, in addition to lessons learned for deepwater developments, we will also show how very similar our situation is to that of our risk counterparts in other industries. To do so, a recent study on emerging risks sponsored by the Financial Times, is worth summarizing.
In January of this year, the Financial Times, in collaboration with the consultancy Oliver Wyman, conducted a global, multi-industry survey of 650 executives in the energy, financial, manufacturing, life science, technology, and transportation industries called "Global Emerging Risks Survey, Steering the Course, Seizing the Opportunity."
These emerging risks were defined as not only "new" risks, but those familiar risks in new or unfamiliar conditions. Arguably, today, deepwater risks for oil and gas exploration and production are emerging risks under this definition. In fact, because nearly 40 of the respondents to the study were from the oil and gas industry, E&P risks actually contributed to the study results.
Conclusions from Global Emerging Risks Survey
The conclusions from the Financial Times study that seem to best parallel those of the upstream oil and gas industry are:
Many companies are going through the motions, but their risk management systems are not very effective.
- The largest portion of respondents (more than one-third) consider their biggest challenge is aligning risk data to strategies and operations.
- 62% of senior executives surveyed rate their companies as only "moderately effective" or "ineffective" at integrating risk information into ongoing business decisions.
If we were to receive anonymous and candid responses from our executives, would we find that their business strategies and decisions for deepwater developments are effectively aligned with solid risk information?
There is poor communication of risk information across organizations due to "siloing" and poor risk information systems, and 56% of the executives cited regulatory policy risk as their second largest risk, after that of global economic recession. Yet, government relations departments receive risk information "infrequently."Thus, regulatory risk information is siloed from those who are most affected.
In the aftermath of the Montara and Macondo disasters, our customers are saying that regulatory policy change ranks up with commodity price change as their largest risk. In the US, we see operators and drilling companies struggling to filter regulatory changes down through the organization on issues such as blowout contingency planning and worst-case discharge scenarios.
Executives see a huge disconnect between strategy, operational planning, capital allocation, and risk management practices.
Electronic information systems (intranet) are not being used to communicate risk information. Only 24% of respondents said they are posting risk information on the company intranet.
Whether it is regulatory risk, or project cost and schedule risk, how many exploration and production operators maintain a "real-time" electronic risk information system to share risk information across their organizations?
Companies are not using a "fit-for-purpose" risk management approach and have been unable to cull the important from the trivial. One executive stated, "We've cut down the frequency of our risk assessments because we end up with too many risks on our register and not enough time to do anything about them."
About 25% of respondents consider insufficient time and resources to be their primary challenge. In the oil and gas industry, we may echo this, "not enough resources" sentiment, but in response I ask: Is it about working more or working smarter?
Risk information integrity is suspect due to the quality of the data inputs. Simplistic, univariate approaches are the norm but companies see a need for more multivariate and quantitative risk techniques.
Companies in the survey rely too heavily on simplistic and internally generated qualitative data to make risk-related decisions. There is heavy reliance (69% said) on internal subject matter experts for emerging risk information. Often these in-house experts are content specialists in a specific technical discipline but don't really know how to look for and analyze market information and know very little about strategic planning. This again contributes to risk siloing.
Qualitative multivariate techniques such as scenario analysis, risk mapping, and decision tree analysis are being increasingly used. However, simulation exersizes, such as probabilistic modeling are not often used and 20% to 30% of the respondents thought they should be.
Are we using only univariate approaches to deal with uncertainty in deepwater development? Should we be using more probabalistic and/or multivariate approaches?
To answer some of these questions and more, we will consider current control by the asset manager of the risks all along the well's life cycle. In the early stages of a development, the asset manager is effectively its project manager, so it is useful to examine whether the project delivery processes in use are adequate.
Project delivery processes in use today
A review of the project delivery processes of various investor owned oil and gas companies shows them to be similar, whether it is BP's Major Projects common process (MPcm), Chevron's Project Development & Execution Process (CPDP) or Nexen's Investment Decision Process(NIDP). Thus, in Figure 1 we show what might be considered a typical oil and gas company project delivery process for an upstream offshore development.
Relevant commonalities among companies in this process are the risk analysis steps (shown in yellow), and process hold points, called "decision gates" or "stage gates" (shown in red) at each phase of the process.
Among the operators we have worked with, the project delivery approach is surprisingly similar, deploying different teams at each life-cycle phase (pre-concept, concept, etc.) using various management tools to deliver what is called project risk "artifacts" at the end of each phase.
As shown in Figure 1, examples of these artifacts could range from risk registers in the concept phase to checklists, protocols, and forms for the management of change during the implementation phase. Operators' project delivery processes are similar, yet our market research shows their lack of success in execution is largely due to what they are not doing. What is lacking is a supporting risk-based management system underpinned by an electronic risk information infrastructure that allows real-time monitoring of the project's risk profile.
Empirical support for the parallels in emerging risk management
A survey performed by Boots & Coots in April 2010 of oil and gas company operators' HSE management systems concluded the following:
There is no upstream oil and gas industry standard (i.e. best practice) for HSE Risk Management Systems. Instead there is considerable variation in both the structure and the content of HSE management systems among operators. Among those surveyed, the HSE management systems usually have either 11,12, or 15 elements, they follow an ISO management system structure, and are consistent with the Occupational Health and Safety Assessment Series (OHSAS)18000 management system guidelines.
The American Petroleum Institute (API) and the Oil and Gas Producers (OGP) Exploration and Production Forum have frameworks for Management Systems, and ISO17776 contains an excellent description of tools and hazards for offshore development. These are industry accepted guidelines, but they are not consistently used.
There are few, if any, truly risk-based management systems in place. This is despite the fact that all operators had hazard and/or risk management as one of the elements in their management system. They also all included hazard/risk workshops and analysis among the steps in their project delivery process. Scenarios and decision trees are not often used, a parallel to the Financial Times study cited earlier.
In contrast to common practice, a risk-based management system is one built from the ground up, forming each element and requirement of the management system from either a barrier or a control that is part of a major event's threat line. Threat lines in turn form parts of a particular scenario approach called "bow-tie" diagrams.
Since the Piper Alpha accident in the UK North Sea, bow-tie diagrams have been used for scenarios in the oil and gas industry to support safety cases for offshore exploration and production. In spite of their use, bow-tie practitioners generally use bow-ties to demonstrate that their existing management systems are effective rather than use bow-ties as the basis for effective design of their management systems. What if we were to pare down our management system to only those requirements that we could support through a risk analysis? How much more efficient and effective could they then be?
Operations risk professionals at oil and gas companies studied do not rely on integrated electronic risk information systems. This is in stark contrast to their counterparts in the finance or the trading and marketing departments where SAP, JD Edwards, OpenLink, Triple Point Technology, or other enterprise-wide management information applications are common.
Conclusions concerning minimum elements of robust approach to oil, gas company risk management
In summary, what is often lacking is a management system that is risk based, consistent with international best practice, underpinned by an electronic information system and maintained over the entire life-cycle of an oil and gas well or field. As mentioned before, though the delivery processes are similar, poor execution at the interfaces between phases often causes problems because risk information is not adequately handed off to the next team.
One way to resolve this is to require the teams in each phase to feed risk information into a common risk information system throughout the project life cycle. One of the first risk standards where this need was highlighted was in the Canadian Guideline CSAQ850 in the mid1980s – well before the widespread use of corporate PCs to access and communicate management information.
Yet today, outside of financial risk, the oil and gas industry is still not consistently using enterprise-wide risk information systems in spite of our more sophisticated computer capabilities. In today's world of web portals, relational databases and iPod apps, there is no excuse to not have such a system. Figure 2 illustrates one basic concept for such a system as developed by Boots & Coots.
Focus on big picture, but track the critical details
Stage gate processes are a good start for looking at the big picture, but when they are ineffective, it is because they fail to manage the interfaces between phases. Here is where the asset manager must provide the leadership to ensure the information is transferred between phases, during the "crew changes."
Even with one person guiding the process, risk information is lost if a common risk register is not transferred from one crew to another across the stage gate. This is particularly prevalent between pre-concept and concept phases, and between installation and operations.
When information is lost between phases, the operator does not have a current risk profile and is driving in the dark with their headlamps off. To mitigate against this loss of risk information, oil and gas companies should establish a perpetual risk register at the beginning of the pre-concept phase enabling it to maintain, capture and communicate the risk profile at any time over the life-cycle of the well or field.
Some operators, such as Shell have attempted this perpetual risk register approach with some success during the feasibility, development, and implementation phases by instituting an electronic, web-based risk register, but there are no operators who maintain such an artifact over the entire life-cycle, from pre-concept through termination.
Beyond a stage gate approach, leading-edge operators should consider the well or the field as an enterprise, with its own structure for accountability as a business entity (including "enterprise risk management"). To facilitate this perspective, one approach I have developed involves an icono-graphic method called Enterprise Value Chain Mapping, which captures scenarios and issues at an early stage in the project's life cycle and then relates them to the broader corporate risk profile. More detail can be found on Enterprise Value Chain Mapping in an earlier work dealing with corporate risk management in the energy industry (Energy, Risk & Competitive Advantage: The Information Imperative, published by PennWell Corp. in 2008).
Risk information integrity is often suspect due to the quality of the data inputs. Univariate approaches are the norm, but we should consider more multivariate and probabilistic techniques.
Though it seems counterintuitive that quantitative techniques would not be as useful as qualitative approaches under conditions of uncertainty, the opposite is true. Where there are high uncertainties (as with deepwater E&P) and capital expenditures are significant, this is precisely where probabilistic quantitative techniques such as Monte Carlo simulations using fairly inexpensive, commonly available software tools, should be used more often.
In fact, probabilistic tools have already been advocated by petroleum industry experts such as Dr. James Murtha and others for real-time support of decisions. In spite of this, in the area of catastrophic HSE risks, Monte Carlo tools have yet to be adopted extensively. This is largely due to the misperception of "needing better data" to support any type of quantitative analysis.
Optimize risk/reward, improve stakeholder assurance, and create competitive advantage
Thus far we have dealt with what may be lacking in the industry, but what would it take for risk management to become a game-changer for a new breed of energy company in the 21st Century?
Historically, risk management has been regarded as primarily threat avoidance or consequence mitigation. In fact, the existence of maritime uncertainty before the benefit of mathematics meant that ancient shipping, prior to the 13th century was little more than gambling against the hazards and perils of an evil outcome. Today, even with the advantage of probability theory, the concept of risk still carries an overwhelmingly negative connotation, and hazards and perils for the upstream oil and gas industry still fall primarily into the following areas:
- Running afoul of regulatory or legal requirements
- Fear of catastrophic consequences
- Non-compliance with internal company standards or board-level directives
- Upsetting of public and shareholder relations
Yet just as the foundations of risk management were built upon mathematics and games of chance (implying the possibility of an upside), modern risk management should also look at opportunities in addition to threats, in order to maximize reward as a legitimate goal of risk management. In fact, leading-edge risk management today in the fields of project risk and enterprise risk, consider not only the threat, but the opportunities side of the risk matrix when evaluating development prospects.
Leading-edge oil and gas operators, through better risk management, can optimize the cost/benefit relationship of expenses they could be wasting on well control risk activities that do little to reduce, mitigate or transfer the risk of blowouts.
We have already seen examples of this involving decreasing the Operator's Extra Expense insurance premiums through better quantification of their exposure to blowouts and fires. This desire among its customers for expense reduction is a key driver for the growth of our WellSure services group, which links risk management to reduced insurance premiums and lower blowout response service fees.
An analogous trend has occurred over the past 12 years in the refining and petrochemical industry as risk-based cost savings are the motive to develop and implement risk management systems inspection and mechanical integrity of static equipment using API Recommended Practice 580. The upstream industry has begun to adopt API 580/581 as well, with Petrobras applying these concepts to its Floating Production Storage and Offloading (FPSO) units. Marine class societies have also widely advocated its use in recent years.
In both cases, money is saved through the efficient management of identified threats, not just through the avoidance of possible consequences. Better risk information and systems create cost savings, and cost savings create competitive advantage.
Finally, improved stakeholder relations through diligent risk management can provide a benefit in itself, if properly managed. Competitive advantage over others in bidding rounds, as well as minimizing the expense of protracted permitting and payment delays can result from superior risk processes, if properly designed and executed.
In this post-Macondo environment, improved risk management and public transparency could create a significant competitive advantage to oil and gas companies of the early 21st century, just as the race for cheaper raw materials and automation aided manufacturers in the early 20th century.
About the author
More Oil & Gas Financial Journal Current Issue Articles
More Oil & Gas Financial Journal Archives Issue Articles
View Oil and Gas Articles on PennEnergy.com