Top risks in oil and gas

The survey was conducted in the fourth quarter of 2015. Each respondent was asked to rate the risk issues using a 10-point scale, where a score of "1" reflects "no impact at all" and a score of "10" reflects "extensive impact" to their organization over the next year. For each of the 27 risks, we computed the average score reported by all respondents.

Using mean scores across respondents, we rank-ordered risks from highest to lowest impact. This approach enabled us to compare mean scores across multiple years to highlight changes in the perceived level of risk. We viewed risks rated with an average score of 6.0 or higher as having a "significant impact" over 2016 and beyond. We focused on several industry groups, including 47 respondents who represented oil and gas businesses.

The top five risks for oil and gas companies, based on the 2016 survey results, are summarized in Figure 1.

Despite widespread upheaval due to extreme declines in oil prices globally, this year's top risks for the industry are generally consistent with those from 2015. This may reflect the experience, competence, and steadiness of boards and executive management in addressing these concerns. However, although oil and gas companies basically understand their risk environment, many may have remained in denial about the magnitude and duration of the extraordinary declines in oil prices during our survey period, as we discuss further below.

REGULATORY CHANGE AND SCRUTINY

For the fourth consecutive year, oil and gas executives cited regulatory change and scrutiny as the top risk that their organization faces. While the usual worries about regulatory actions to restrict hydraulic fracturing, expand health and safety requirements, and increase environmental enforcement directed at oil and gas operations continue, banking regulations are also a concern.

As oil prices remain low and the value of oil-based assets collateralizing bank loans sinks below outstanding loan balances, regulators frequently require lending institutions to withdraw credit. This in turn forces debtor companies to take extreme financial measures to stay afloat.

ECONOMIC CONDITIONS AND PRICE RISK

Across the entire industry, some risk scores in the survey actually declined compared to the 2015 results. The full extent of oil's price drop had not yet occurred when the survey period expired in the fourth quarter of 2015. But with the subsequent fall of an additional 25% in oil prices off the 2015 peak following the survey period, many companies found their operational, liquidity, and survival options significantly constrained.

If this survey had been conducted in the first quarter of 2016, economic conditions almost certainly would have been rated as the top risk, with the price point of oil in the US$30 per barrel range and an uncertain consensus outlook regarding the rebound. Natural gas prices also collapsed, forcing many natural gas producers to adjust their operations significantly.

The bottom line is that many oil and gas companies have been forced to replace growth with survival as their top priority objective. Risk responses that are being implemented virtually across the board by these organizations include large-scale layoffs, major reductions in capital spending, asset sales, restructurings and even bankruptcy filings. For very large energy companies with strong balance sheets and risk-tolerant private equity investors, these circumstances produced a wide range of buying opportunities, as these organizations are well-positioned to endure the current uncertainty.

The good news is that there has been some recovery (above $40 at the time of writing this article). However, looking forward it is unclear as to when prices will fully recover and what the price point will be once that happens.

CYBERSECURITY

Cybersecurity, which saw a significant rise on the risk scale in 2015, remains a critical risk this year, albeit at a slightly reduced level. Energy companies are fully aware of the cyber-risk environment, as well as the imperative to marshal management and board attention, implement technological solutions, and increase investment to protect against criminal, competitive and nation-state threats.

To that end, it is vital for companies to identify their "crown jewels" - the assets they cannot afford to lose - as well as understand changes in their cyberthreat landscape. They also must have an effective incident response program in place.

In addition, it is important for oil and gas companies to recognize that cybersecurity risks do not apply only to corporate administrative systems, but also industrial control systems (ICS) such as SCADA networks. All of these risks emphasize the need for organizations to ensure that they have a comprehensive security program in place and are testing it regularly.

PEOPLE-RELATED RISKS

The fourth and fifth ranked risks for oil and gas companies were people-related: resistance to necessary changes in the business model and core operations, and inability to attract and retain top talent and plan for succession. Both risks are front and center as the oil and gas industry experiences downsizing and layoffs and companies rightsize their operations to fit economic realities.

Uncertainty about the supply-and-demand environment makes it difficult for oil and gas companies to formulate a clear view as to how their organization will operate in the future - and hold on to the talent needed to execute challenging growth strategies. Every company must have a comprehensive talent strategy with a longer-term horizon on sustaining its leadership and talent pipeline; that requires them to maintain strong executive depth that extends two to three levels below the C-suite. That's hard to do when organizations are contracting.

OTHER RISKS ON THE RADAR

The top five risks to oil and gas companies cited by executives and directors polled for the 2015 survey present formidable challenges. When comparing the 2016 and 2015 risk ratings, it is clear that there has been a general year-over-year decline in regulatory, economic and cybersecurity risks and a slight uptick in the people-related change readiness and talent risks.

In addition, there were three other risks close enough to the top five to warrant a mention:

Shifts in social, environmental, and other customer preferences and expectations may be difficult for the organization to identify and address on a timely basis - Consumer awareness of the climate change debate is on the rise. Pressure on major new fossil fuel projects, and calls for replacing fossil fuel production and consumption with alternative clean sources of energy that, in effect, leave carbonized fuels in the ground, create uncertainty as to the nature, extent and speed of change to an increasingly carbon-constrained world. This dynamic, coupled with declining disposable incomes, can have dramatic effects on consumer behavior, reducing consumption. Taken together, these dynamics have oil and gas companies concerned about how they will prepare for and adapt to new market realities.

The organization may not be sufficiently prepared to manage an unexpected crisis significantly impacting its reputation - Recent terrorism events, economic conditions in China, volatile oil and gas prices, major accidents, and high-profile cyber data breaches vividly illustrate the reality that oil and gas organizations face risks that can suddenly propel them into global headlines, creating complex enterprise-wide risk events that can threaten viability, reputation and brand image.

The rapid speed of disruptive innovations and/or new technologies within the industry may outpace the organization's ability to compete and/or manage the risk appropriately, without making significant changes to the business model - The rapid and steep decline in oil prices was not anticipated by many players in the energy industry and is a strong reminder that these businesses should always expect the unexpected. It is worthwhile to understand the critical assumptions underlying the strategy and identify the vital signs that can provide management and the board with early warning that one or more strategic assumptions either are becoming, or have become, invalid.

ADAPTING TO THE SPEED OF CHANGE

In addition to rating risks, executives and directors also answered two broad questions:

• Overall, what is your impression of the magnitude and severity of risks your organization will be facing with respect to reaching or exceeding profitability (or funding) targets over the next 12 months?
• How likely is it that your organization will devote additional time and/or resources to risk identification and management over the next 12 months?

Responses for both of these questions reflects a slight decline from the prior year. This suggests that, while the environment remains risky, the perceived risk level has declined somewhat. As we noted earlier, had the question been answered in the first quarter of 2016, a different perception might have been the outcome. Investment levels may have been influenced by the general reduction in spend that was taking place in the oil and gas industry through the end of 2015.

In summary, boards of directors and senior executives at oil and gas companies cannot afford to manage risks reactively, especially in light of the speed of change in the industry that could accelerate beyond the current velocity. That the energy world is changing is not up for debate. The real question is: How fast can energy companies adapt to the speed of change and prepare for the unexpected?

ABOUT THE AUTHORS

Danny Rudloff is a founding Managing Director of Protiviti and global lead for the firm's energy practice. He has over 25 years of experience in the energy industry, serving natural gas transmission, exploration and production, refining and crude oil trading and marketing clients. Email: [email protected].

Michael Schultz is a founding Managing Director of Protiviti and the firm's Houston Office Leader. He also serves as Protiviti's global leader for IT Strategy and Architecture and has more than 28 years of corporate and professional experience in technology consulting, internal audit and risk management. Email [email protected].