Accenture 2013 Global Risk Management Study Focus on findings for the Energy and Utilities sector 2 Contents
About the research 4
Executive summary 5
Key findings 7
Section 1 10 Current market pressures
Section 2 12 Managing regulatory and compliance risks
Section 3 14 Managing emerging and operational risks
Section 4 20 Risk capability goals for 2015
Section 5 24 Four things to do differently
Research and interviews were conducted by Accenture and Oxford Economics, who collaborated to write this report.
3 About the research
This report on energy and utilities firms is a sector- specific supplement to the Accenture 2013 Global Risk Management Study.1
This report is based on a quantitative survey taken in 2013 of executives from 105 organizations in the energy and utilities industries. Respondents were C-level executives involved in risk management decisions. Organizations were split among Europe (30.5%), North America (27%), Latin America (12%), and Asia Pacific (30.5%). Just over half the companies had annual revenues between $1 billion and $5 billion, and 48%, had annual revenues over $5 billion. Respondents included Chief Risk Officers (CROs, 30%), Chief Executive Officers (CEOs, 17%), Chief Financial Officers (CFOs, 31%), and Chief Compliance Officers (CCOs, 22%).
We also conducted in-depth interviews in 2013 with senior leaders at nine energy and utilities companies across regions. These provide supporting insights for our data- driven research, while presenting useful perspectives from companies in the sector.
4 Executive summary
It is not surprising that over half of Broad regulatory reform to help address For example, as the size and the energy and utilities respondents both financial derivative activity and complexity of energy company to the 2013 Global Risk Management asset integrity can be a challenge projects continue to grow, so do Study, on average, expect risks to rise to companies investing heavily in the risks associated with delivering more significantly over the next two complex production and delivery major capital projects on schedule, years when compared to respondents infrastructures, and operating within within budget and scope.2 Forty in other industries (see Figure 1). In a daunting business environment. percent of our research respondents our experience, energy and utilities Large-scale capital expenditure now have risk officers identified, and companies have historically viewed programs will likely continue to be assigned specifically to their capital market and credit risks as the key exposed to numerous operational projects programs (see Figure 13). risks to mitigate. These seem inherent risks as well as shareholder scrutiny. This compares with roughly 60% to their core business due to the Increased competition is pushing firms having risk officers for credit, market, volatility of the commodities that to explore new frontiers and to make and operational risk management they produce and utilize as feedstock unconventional plays, placing further efforts, and raises the critical for refining and generation. strains on production efficiency and question of whether organizations safety. Energy and utilities firms may are dedicating their scarce talent to In the past few years, tragic, high- need to move from incremental add- the most important areas of risk. profile operational risk failures could ons to more significant step changes be seen as contributing factors in in enhancing risk management Risk analytical capabilities, such as the destruction of shareholder value, capabilities. Most survey respondents cash flow-at-risk, rigorously applied significant fines from regulators, and are still expending significant during upfront planning and throughout exposure to reputational risk. In some effort on manual tasks such as data the project lifecycle can trigger early cases, litigation stemming from the management for both market risk and intervention strategies. Similarly, operational risk failures has added credit risk management, consuming these techniques can support risk- additional costs to the regulatory more than a quarter of their risk adjusted capital allocation, liquidity fines. Although operational risk management resources (see Figure 16). management and, capital-adequacy failures are not new to the energy considerations as energy and utilities and utilities industry, these events, In our view, this sector might benefit companies evaluate competing coupled with aging infrastructure from the recognition that a robust risk investments across their portfolios. and a changing workforce, may have management function can help support helped intensify regulatory and policy the organization’s response to increased The survey results indicate a greater shifts in terms of compliance. legal and regulatory compliance risk emphasis on the risk management exposure. By expanding beyond a function. And, the skills and capabilities This regulatory focus on aging assets traditional approach to enterprise of the people in the function speak to may have helped create the turbulent and trading risk management, energy the greater role respondents feel risk climate through which today’s risk and utilities companies managing management can play moving forward. professionals plot a course to their compliance with an eye towards For example, the 2013 Global Risk next destination. Energy and utilities business and culture transformation– Management Study results cite one area companies use derivative instruments embedding a centralized approach of focus over the next several years to to help manage the volatility of the within the risk management function— be the development of risk technology commodities core to their businesses; can gain efficiencies that may help and data to achieve Risk Mastery (see as the uncertainty about the regulatory offset the costs associated with Figure 15). Along with the difficulty of oversight of the market has helped add increased compliance. embedding risk analytics in management a layer of complexity to the landscape. processes, survey respondents also Policy uncertainty and regulatory highlighted the importance of infusing complexity may have also affected a culture of risk in the organization. companies in areas ranging from production planning to trading and customer relationships.
5 Organizations could benefit from Looking ahead, we believe energy and identifying and correcting sources of utilities firms need to consider focusing operations risk vulnerability, not only on the following four areas, discussed in to help improve value creation but to greater detail in Section 5: enable competitiveness in new business environments and unconventional • Extend the capabilities of the risk projects. New technologies capable of management function–to help firms capturing operational data at remote manage the full suite of risks to which sites such as offshore platforms and they are exposed compressor and transmission stations • Manage compliance through a can provide new opportunities to transformational lens–centralized strengthen traditional risk cultures in management and aligned with these sectors. business objectives that can also deliver on regulatory requirements Creating a risk culture that extends all the way from top management and the • Identify and correct sources of Board of Directors to each employee can operations risk vulnerability–focused no longer be an aspiration for energy on both “macro” threats and “micro” and utilities firms—it is a fundamental issues key to success. • Focus on the “human element” of risk—to turn obstacles into We explore these themes and more opportunities for successfully in the following sections, starting deploying risk analytics with Section 1, “Current market pressures,” Section 2, “Managing regulatory and compliance risks,” and Section 3, “Managing emerging risk and operational risk.” We then present survey respondents’ capability goals for 2015 in Section 4.
6 Key findings
Energy and utilities firms are more likely to expect risks to rise…
53% 48% 45% 41% 36%
Banking, Healthcare, Insurance Public Capital markets Life sciences services Energy, Utilities
Averaging across risk types, 53% of energy and utilities firms believe risks will rise over the next two years
…and perceive legal and regulatory risks as their A large share of firms—especially in energy—spend top threats one-quarter of their operational risk time on aftermath of risk incidents 72% Legal 42% risks 62% Emerging Regulatory risks requirements 51-75% 15%
50% 58% Strategic Business risks risks 26-50% 44% 36% Organization 50% 58% Liquidity Market risks risks Energy Utilities 51% 55% Credit Operational risks risks
What do executives see as the biggest risks over the next two years? % of respondents claiming to spend at least one quarter of their operational risk management time dealing with the aftermath of risk events
Under-resourcing of capital projects programs may lead to more undetected operations risk events
To a larger degree To a moderate degree
Safety 43% 46% Only 20% of energy and utilities firms report a large Execute/Construction 64% of projects degree of operations—capital 24% project integration in the early project phase Utilization/Efficiency 50% 34% Early phase/Stage 63% gates of projects 20%
Degree that operations personnel are integrated with the capital projects program in each area. 7 8 9 Section 1 Current market pressures
We at Accenture believe that policy Figure 1. Proportion of respondents expecting risks to rise, by sector shifts, new sources of supply, and How do you expect the following risks to change over the next 2 years? economic turmoil have been buffeting energy markets worldwide. As Proportion saying “rise somewhat” or “rise significantly” governments pursue conflicting goals of energy security, environmental impact Energy, Utilities reduction, and cost control, energy 53% policy has become more volatile. It also Banking, Capital markets appears that new emerging market- 48% based resources players are intensifying competitive pressures. Healthcare, Life sciences 45% In this context, energy and utilities respondents are more likely to perceive Insurance risks as rising than any other sector (see 41% Figure 1). Averaging across all risk types, Public services a majority of these respondents (53% 36% in both industries) believe risks will rise over the next two years. Source: Accenture 2013 Global Risk Management Study
Looking at risk categories of greatest Figure 2. Heat map of rising risks for energy and utilities companies concern, legal risks are most frequently expected to rise, particularly litigation How do you expect the following risks to change over the next 2 years? challenges related to capital projects Proportion saying “rise somewhat” or “rise significantly ” and major investments. These risks are a Regions where risks are rising threat not only in emerging economies, but also in North America and Europe. Risks rising most over North Asia Latin Legal risks are increasingly leading to next two years Europe America Pacific America disruptions of major projects, putting Legal risks large investments at risk. “Investments in the US and Canada involving Regulatory requirements intensive development processes such as water utilization are activities that Market risks increasingly end up in litigation,” notes Business risks the head of risk at a US-headquartered energy company. Operational risks
Strategic risks
Energy and utilities Liquidity risks respondents are more likely Credit risks to perceive risks as rising Emerging risks than any other sector: 53% Political risks believe risks will rise over the next two years. Reputational and brand risks
33% or less of respondents expect rising risk 34% to 66% of respondents expect rising risk At least 67% of respondents expect rising risk
Note: Due to small sample sizes in some world regions within energy and utilities, interpretation should be illustrative/directional only Source: Accenture 2013 Global Risk Management Study 10 On the heat map, regions with the Figure 3. Proportion of respondents expecting risks to rise greatest exposure to rising risks appear How do you expect the following risks to change over the next 2 years? in Figure 2. These risks expected to rise most substantially are listed on the left, in Proportion saying “rise somewhat” or “rise significantly” descending order. The upper-right corner is the “hot zone:” Orange circles indicate a Energy risk/region combination for which at least 67% of respondents expect rising risk. 1 Legal risks Green circles indicate that 33% or less 80% expect rising risk. 2 Strategic risks Energy respondents are more concerned 60% about rising legal risks than utilities (80% 3 Business risks and 64%, respectively). This concern likely 58% represents the increased legal pressures that unconventional developments, such 4 Operational risks as shale oil and gas, can face. Utilities 56% respondents, meanwhile, are more concerned about rising regulatory risks 5 Liquidity risks (72% and 53%, respectively). See Figure 3 55% for a list of top five risks by industry. Utilities In the utilities industry, regulatory change can intensify market pressures dramatically. 1 Regulatory requirements For example, “Germany’s very ambitious 72% scheme for renewables has changed the 2 Market risks landscape of power pricing,” explains Dr. Michael Herrmann, Head of Commodity 66% Management at RWE, a European energy 3 Legal risks company. The installation of approximately 64% 33 gigawatts of photovoltaic capacity in Germany has had the effect of eliminating 4 Credit risks the longstanding noontime peak in power 58% prices. “Power plants built with embedded flexibility to address this peak load are now 5 Business risks largely idle,” he says. 58%
Looking at risk categories Source: Accenture 2013 Global Risk Management Study of greatest concern, legal risks are most frequently expected to rise, particularly litigation challenges related to capital projects and major investments.
11 Section 2 Managing regulatory and compliance risks
As a result of these rising legal and Figure 4. Importance of risk management function in achieving organizational regulatory threats, the risk management goals function is taking on a new compliance How would you rate the importance of your risk organization as a means of achieving role, moving beyond its traditional the following? Proportion saying “important” or “critical” role of managing trading-related risks to address front-office operations as well as overall risk governance. In fact, Compliance with regulations in some cases, meeting compliance 98% requirements can require so much effort 100% that risk managers must sacrifice other Managing reputation objectives, at least temporarily. “The 89% task of long-term risk management in 98% our case fell slightly by the wayside, Enabling long-term profitable growth because of the effort needed to be 71% put into remedying deficiencies with 90% Sarbanes-Oxley compliance,” notes Infusing a risk culture Antonio Joao Queiroz Lima, Head of Risk 73% and Internal Control at Eletrobras. 86% Despite the novelty of this compliance Managing liquidity and cash flow role, expectations are high. All 78% 76% utilities respondents say the risk management function’s compliance role Reducing cost of capital is “important” or “critical,” along with 67% 80% 98% of energy respondents. Compliance is the most frequently reported goal for Improving capital allocation the risk management function in both 67% industries (see Figure 4). 78% Reducing operational, credit or market losses “In the past year and a half, we’ve 58% hired a chief compliance officer and 86% we’re working together to roll out Risk-adjusted performance management a global compliance program,” says 60% Jonathan Stein, CRO and VP of the 76% Hess Corporation, explaining his firm’s Innovation and product development integrated approach to managing 64% regulatory change. “We’ve also 68% developed regulatory experts across Managing economic and financial volatility the firm with deep understanding of, 65% not only the rule-making process, but 66% how it will impact us and how we can keep up with the changes.” For utilities, Energy Utilities taking such a proactive approach to Source: Accenture 2013 Global Risk Management Study regulation is also relatively new. “In Accenture’s experience working with the utilities industry, until recently there was no such thing as a regulatory affairs department or person with the title ‘chief of regulatory affairs,’” notes Sander van ‘t Noordende, Group Chief Executive, Management Consulting at the company. “But since the late 1990s, they’ve been popping up everywhere.” 12 Managing regulation Figure 5. Proportion saying a lack of alignment between regulatory reform and long-term strategy impedes risk management function effectiveness through a transformational To what extent do the following challenges impede the effectiveness of your lens organization’s response to regulatory change? Proportion saying “to a great extent” or Some organizations in both the “to some extent” energy and utilities industries leverage regulators’ compliance Energy demands to create risk management 53% function capabilities that serve their organization’s wider needs and Banking goals. This can be done by devising 49% a strategic plan for developing risk capabilities and managing Healthcare compliance demands centrally. 48% Government administration The challenges in managing compliance pressures in such an integrated way 46% is clearly acute in the energy industry, Life sciences however, where 53% of respondents 38% report a lack of alignment between regulatory pressures and long-term Utilities goals—the highest proportion of 38% any industry. This issue is less acute Insurance in utilities, although nearly 40% of respondents report a lack of alignment. 35% Postal 30%
Capital markets 24%
Source: Accenture 2013 Global Risk Management Study
“We’ve developed regulatory experts across the firm with deep understanding of, not only the rule-making process, but how it will impact us and how we can keep up with the changes,” says Jonathan Stein, CRO and VP of the Hess Corporation.
13 Section 3 Managing emerging and operational risks
Energy and utilities respondents are Figure 6. Current emerging risk capabilities more confident than any other sector in Please indicate where your risk management function currently performs on each of their ability to manage emerging risks the following: Emerging risks—Proportion saying “4” or “5” on a 5-point scale (see Figure 6). And they overwhelmingly contend that their ability to manage Energy emerging risk—risks that are developing 38% or dynamic—is effective or very Utilities effective (see Figure 7). No firms from this sector described their ability to 38% manage emerging risk as ineffective. Healthcare 35% At the same time, our research Capital markets findings show there may be room for 31% improvement. A large majority—86% of both energy and utilities respondents— Life sciences say they are at least “moderately” 31% prepared to deal with strategic and risk Postal implications of new sources of energy 30% supply. But only 10% of utilities firms Government administration and 16% of energy firms say their firm 29% is prepared “to a large degree” (see Banking Figure 8). 29% Insurance 26%
Source: Accenture 2013 Global Risk Management Study
Figure 7. Effectiveness in managing emerging risk How effective is your company at managing emerging risk? Energy 16% 53% Utilities 10% 68%
Very effective Effective
Source: Accenture 2013 Global Risk Management Study Many respondents, particularly in the energy Figure 8. Preparedness for the strategic and risk implications of new sources of industry, report spending energy supply more than a quarter of How well prepared is your firm in researching and developing strategic and risk management responses to the implications of new sources of supply in the energy and operational risk management utilities markets? time dealing with the Energy aftermath of risk incidents. 16% 69% Utilities 10% 76%
To a large degree To a moderate degree Source: Accenture 2013 Global Risk Management Study
14 Similarly, the level of confidence of Figure 9. Effectiveness in managing acute business disruptions and crises energy and utilities respondents with How would you best characterize your organization’s ability to manage acute regard to crisis management is high, business disruptions and crises? but also could improve further (see Figure 9). Because crises increasingly Energy take place in public view, minimization 27% 56% and management of impacts—including reputational impacts—are critically Utilities important. “I have been working for 38% 46% 25 years in resources, and there has been a night and day change in the Very effective Effective focus on risk,” says Mr. Noordende. “Risk incidents impact your ‘license to Source: Accenture 2013 Global Risk Management Study operate’ and if you have a bad incident, you can be shut down,” he notes. Figure 10. Risk management function enhancements underway or planned in the Many organizations are addressing next two years these challenges by extending the role For which of the following risks are you intending to enhance your corporate of the risk management function into risk management capabilities? Proportion saying “currently working to enhance operational and reputational risk. This is, capabilities” or “enhancements planned in next two years” of course, a very different challenge than managing risks associated with energy Business risks trading. No risk manager can, by him 88% or herself, directly control operational risks such as whether a valve is adjusted Operational risks correctly (see sidebar on page 16). 81% Managing these risks may require a focus Strategic risks on governance, training, and risk culture. 80% A growing focus on Reputation and brand risks operational risk management 80% Market risks The findings show an increasing focus 77% on operational risk, which could reflect an effort to reduce the significant Emerging risks amount of time spent dealing with the 76% aftermath of risk incidents. Companies also report that adequately staffing Liquidity risks management of capital project risks is 75% a continued challenge (see Figure 14). Regulatory requirements The focus on operational risk capabilities 75% may be an effort to address this weakness. Legal risks 71% We asked respondents about the risk categories for which they seek to Credit risks enhance management capabilities, 69% including identification, assessment, and Political risks mitigation. Operational risk features in 64% the top two, reported by 86% of utilities, 76% of energy respondents, and 81% of Source: Accenture 2013 Global Risk Management Study sector respondents (see Figure 10).
15 BP Taking a cross-sector approach to enhancing risk management
To better understand its own risk A central focus of BP’s journey has management needs and take forward been to enhance operational risk cutting-edge best practices, energy management capabilities—to address giant BP took the unique step of issues that are difficult for the risk undergoing a sweeping two-year management function to control change management initiative. BP directly. For instance, BP has a sought to standardize risk identification, new function called the Safety and assessment, and management Operational Risk (S&OR) function, which requirements and reporting across operates at a centralized and embedded the whole organization. The initiative level. One responsibility of this function culminated in the creation of the is to maintain an independent view of position of Head of Group Risk at BP. safety and operational risk, and S&OR works closely with the company’s Head In this process, BP went well beyond of Group Risk. their own industry scope to look at best practices in risk management. BP staff Of course, in enhancing risk joined cross-industry working groups on management capabilities, the journey is risk. They talked to staff in companies never over. New tools are continuously across various industries including developed. One development mining, telecoms, and financial services, opportunity is to bring various risk as well as oil and gas competitors, analytics data together and link them to see how risk is managed in each more clearly to planning activities in of these organizations, explains Geir managing operational risk. “But there is Robinson, BP’s newly installed Head of also a delicate balance in not upsetting Group Risk. the processes that are ultimately managing risk out in the field,” Mr. Along the way, BP developed a view Robinson concludes. of some important differences in how different firms manage risk. “The risk management function at some banks might actually own the particular risk metric and have power to veto actions that may take exposures above defined limits,” says Mr. Robinson. “At BP, the business lines must own their operational risks.” The risk management function can proactively foresee there is a risk, and executive oversight processes can be defined. But ultimately it is up to BP’s businesses to manage the risks.
16 17 “Operations risks” are an increasingly Figure 11. Percentage of overall operational risk management time spent on important element of operational major risk events arising from process failures or personal safety failures risk exposures. These threats include physical risks, associated with Energy production, delivery, and storage, 44% 15% and external risks, such as legal Utilities and environmental exposures. 35% 0% (See “Defining operational risk” at the end of this report.) Between 26% and 50% Between 51% and 75% For some respondents, these operations risks are already front and center. Source: Accenture 2013 Global Risk Management Study “Our top concern is commodity volatility, followed by project execution risks, and then emerging risks like Figure 12. Current and future focus areas for operational risk capability political and social requirements,” development notes the head of risk at a US- headquartered energy company. With regard to operational risk, select the option that applies to each of the following capability development initiatives But there is reason to believe many companies may be underestimating Processes for identification of operational risk events and vulnerabilities the impact of such threats, despite the 67% 33% significant amounts of capital inherently at risk in resources projects. Many Operational risk measurement capabilities respondents, particularly in the energy 83% 16% 1% industry, report spending more than a Crisis management and communication office quarter of operational risk management 41% 56% 3% time dealing with the aftermath of risk incidents (see Figure 11). Governance and processes to coordinate and implement mitigation action plans 47% 45% 8% 1% To help reduce such issues, energy and utilities firms are focusing intensely on Business continuity and contingency plans processes for identifying operational 57% 31% 9% 3% risk events and vulnerabilities: 100% of Operational risk data management surveyed respondents are either doing so today or intend to within the next 53% 33% 10% 4% two years (see Figure 12). The most Reporting with improved business intelligence capabilities popular current area of operational risk 47% 37% 11% 5% capability development is measurement, as reported by 83% of respondents. Currently Engaged Planning to engage in the next 2 years Not planned Don't know The most popular initiative for the next two years is setting up a crisis management and communication office, as reported by 56%. Note: Due to rounding, total may not equal 100% Source: Accenture 2013 Global Risk Management Study
Surveyed energy and utilities firms are focusing intensely on processes for identifying operational risk events: 100% are either doing so today or intend to within two years.
18 Avoiding sources of Figure 13. Proportion of energy and utilities respondents that have separate risk officers for each risk type or program operations risk vulnerability Do you have separate risk officers for each risk type or program?—“Yes” responses Within the area of operations risk, a particular concern is threats arising from Credit risk capital projects programs. Managing 66% capital projects in a way that does not give rise to operations risks is a Operational risk crucial challenge as resources become 60% increasingly scarce. Unconventional Market risk developments such as shale gas and 57% oil now place significant amounts of capital at risk. Many organizations Capital projects program are seeking to address such threats 41% through ERM processes.
Our survey findings identify significant Source: Accenture 2013 Global Risk Management Study vulnerabilities that may increase the likelihood of operations risk events. Capital projects programs are the area of risk exposure least likely to have a Figure 14. Degree to which operations personnel are integrated with capital dedicated risk officer assigned. Only 41% projects programs of energy and utilities respondents have How well integrated are operations personnel with the capital projects program with this resource available, in comparison regard to… with 66% for credit risk (see Figure 13). We believe that an under-resourcing of capital projects programs may result in a Safety higher frequency of undetected emerging 46% 43% 89% risks and an unacceptable level of project delays and budget overruns. Execute/Construction of projects 24% 64% 88% Another specific area of vulnerability identified by respondents is the lack Utilization/Efficiency of integration of operations personnel 34% 50% 84% with capital projects programs at the Early phase/Stage gates of projects early phase of projects. Only 20% of respondents report a large degree of such 20% 63% 83% integration (see Figure 14). This implies a difficult hand-off at early project To a large degree To a moderate degree stage gates, which could be a source of risk vulnerabilities. Organizations most Source: Accenture 2013 Global Risk Management Study successful in avoiding operations risks may tend to have greater integration of personnel in this area, as well as dedicated risk resources assigned to the capital projects program.
19 Section 4 Risk capability goals for 2015
For energy and utilities firms, a top Figure 15. Proportion of firms at a moderate level of risk management function focus area in the next few years is capability today and who wish to move to a high level by 2015 developing risk technology and data (see Proportion indicating a “two year target” rating at “4” or “5” on the 5-point capability Figure 15). Risk Masters make consistent development scale, less proportion indicating a “current” rating at this level, for “Please and updated data available to decision indicate where your risk management function performs on each of the following” makers on an ongoing basis across the organization, and use a distributed risk Risk technology and data management architecture based around advanced 31% technology to increase flexibility and 30% reduce costs. Only 23% of energy and Compliance efficiency utilities respondents place themselves 22% at or near this level today. But a further 36% 31% of energy respondents, and 30% of Risk analytics utilities respondents, seek to reach this 22% level by 2015. 30% Risk organization and governance Of course, there are some notable 20% differences between energy and utilities. 30% Compliance efficiency ranks higher Risk talent as a goal for utilities firms (see also 29% Section 2). And utilities firms rank a 16% number of goals at the same level as Risk policy, appetite, and culture risk technology. This includes the closely 7% 30% related area of risk analytics, as well as risk policy and risk governance— Performance management and reporting highlighting risk’s growing compliance 20% 14% role. For energy, risk talent stands out as a key focus. Risk management processes 15% 18% Risk data/analytics tools Risk and finance integration 16% and goals 14% Overall, it is easy to see why energy and Emerging risks utilities respondents are focused on risk 7% data for 2015. When addressing market 22% risk, more than 60% of respondents Energy Utilities spend more than a quarter of their risk management time on manual tasks such Source: Accenture 2013 Global Risk Management Study as data management. The comparable Figure 16. Proportion of risk management time spent on manual tasks such as figure for credit risk is 48%. Some firms data management have been making headway in this area through significant investment. “Our What percentage of the total analysis/reporting time in risk management is spent on ability to capture data and aggregate manually performing tasks such as data management? it has improved substantially over the Market risk past two years, following investments 1% 11% 49% 35% 4% in technology and revamping our Credit risk processes,” notes RWE’s Dr. Herrmann. 3% 5% 40% 50% 3%
More than 75% Between 51% and 75% Between 26% and 50% Less than 25% Don't know
Note: Due to rounding, total may not equal 100% Source: Accenture 2013 Global Risk Management Study 20 In the capital projects area, the tool Figure 17. Tools in use or for which adoption is planned to measure on-time and of greatest current focus is portfolio on-budget performance of capital projects management, in use by only 36% of With regard to major capital project programs, what processes or tools does the respondents but with a further 55% program management office use to monitor and measure on-time and on-budget planning to adopt it within two years objectives? (see Figure 17). The tool most frequently used today is cash flow-at-risk (by 64% Portfolio management of energy and utilities respondents). 36% 55% 5% 4% Clearly, as risk management functions Cash flow-at-risk become more integrated with the rest of 64% 26% 7% 4% the business and play a greater strategic role, there is a rising need to look at Contribution to variance analysis projects on a portfolio basis. 49% 38% 10% 3% Data management Many tools are in use across the value 49% 37% 10% 5% chain by more than 90% of respondents, including cash flow-at-risk, earnings-at- Predictive capabilities risk, capital-at-risk, and value-at-risk. 53% 30% 10% 6% However, for each of these tools, full Limits management for risk mitigation and decision-making deployment varies from a low of 19% to 45% 35% 16% 4% a high of 30% (see Figure 18). “Value- at-risk” is, of course, very popular in Stress testing capabilities trading. “We use tools including value- 42% 35% 14% 9% at-risk and conditional value-at-risk in Conditional value-at-risk the area of energy trading,” notes Edson 28% 48% 19% 6% Silva, Director of Planning and Control at Tractebel. “We use value-at-risk to Currently engaged Planning to engage in the next 2 years Not planned Don't know assess market risk, and also credit risk,” says RK Mehra, Head of International Note: Due to rounding, total may not equal 100% Source: Accenture 2013 Global Risk Management Study Trade and Risk Management at Bharat Petroleum, one of the largest state- owned oil and gas companies in India. Figure 18. Deployment of risk metrics across the value chain To what extent do you use the following risk metrics covering the energy value chain? Cash flow-at-risk 28% 40% 29% 11% 1% 1% Earnings-at-risk 30% 32% 37% 10% 1% 2% “Our ability to capture Capital-at-risk data and aggregate it has 19% 38% 40% 10% 1% 2% improved substantially over Value-at-risk the past two years, following 27% 39% 29% 9% 2%1% investments in technology Gross margin-at-risk 20% 30% 39% 10% 1% 7% and revamping our processes,” Profit-at-risk notes RWE’s Dr. Herrmann. 25% 30% 30% 10% 2% 9%
0 20 40 60 80 100 120 Fully−in all parts of the value chain Partially: Upstream Partially: Midstream Partially: Downstream Not at all−in no part of the value chain Don't know Source: Accenture 2013 Global Risk Management Study
21 Many companies are currently focused Figure 19. Impediments to the successful deployment of risk analytics on extending the reach of risk measures To what extent do each of the following challenges impede the effectiveness of your such as cash flow-at-risk and earnings- organization’s use of risk analytics? Proportion saying “to a great extent” or “to some at-risk. In explaining his firm’s progress extent” in this area, Mr. Queiroz Lima of Eletrobras explains that the goal is to Lack of skilled staff to develop the analytical models create a probability-adjusted cash flow 55% and income statement to give senior 46% management a quantitative view of the advantages and disadvantages of Difficulty in embedding risk analytics in management processes 56% risk management strategies. “Right 40% now, earnings-at-risk and cash flow- at-risk are done for certain specific Outdated legacy systems instruments or businesses,” says a 49% Risk Manager with an integrated oil 40% and gas company based in Europe. Lack of systems integration “By year end, I would like to have 33% everything covered in those metrics.” 40% Unavailability of, or poor quality of, internal or external data Focusing on risk 44% 24% technology’s “human element” Energy Utilities Source: Accenture 2013 Global Risk Management Study Technology systems are, of course, crucial to reducing the manual effort required in managing risk data. But we find substantial evidence in the energy and utilities industries that the main Many firms may have excellent data Nearly 70% of energy and utilities challenges to the development of risk tools, but lack the right people to respondents identify a shortage of risk data capabilities are related to human interpret data in ways management can business and data analysts. Sixty-five resources. The top two impediments to use. Many high-performance (from a percent point to a shortage of risk successful deployment of risk analytics risk perspective) organizations overcome technologists. Shortages in these risk reported by respondents in this sector this challenge in a number of ways, staff categories are more frequently are both “people issues.” The problem including training. Other resources reported than any other. most frequently reported by utilities organizations attempt to overcome respondents (46%) is a lack of staff these challenges by improving the ways Some organizations address these able to develop models. The problem in which information is presented. “We issues via well-developed recruitment most frequently reported by energy had a big data warehouse, with a lot and retention programs for risk talent. respondents (56%) is the difficulty of of great data, but not a lot of people “People with a quantitative background embedding analytics in management could access it,” says Hess Corporation’s typically have a high level of motivation processes (see Figure 19). Mr. Stein. “So we created business and are looking for interesting work,” intelligence tools on top that allowed says RWE’s Dr. Herrmann. “Integrating people to access it.” with the rest of the business gives them increasing responsibility, which motivates them, and results in lower We find substantial attrition,” he adds. evidence in the energy and utilities sector that the main challenges to the development of risk data capabilities are related to human resources.
22 23 Section 5 Four things to do differently
Many energy and utilities organizations 2. Manage compliance 3. Identify and correct have made great progress in developing risk management functions that can through a transformational sources of operations risk play an elevated organizational role lens vulnerability effectively. Companies that wish to reach their risk capability goals for 2015 Regulators’ growing compliance Energy and utilities companies lead may consider the following actions. demands across areas as diverse as other sectors in their capabilities for trading and environmental compliance analyzing and managing emerging risks. can actually provide a lever to achieve But often the focus risks are “macro” 1. Extend the capabilities this needed transformation of the threats, such as new sources of supply. of the risk management risk management function. Escalating There is a growing need to focus on compliance requirements can require a “micro” issues, such as litigation that function great deal of investment and in some disrupts project development. Some Current market pressures are asking cases create a distraction from the companies are enhancing the risk the risk management function to organization’s own risk capability goals. resources available to capital projects broaden its capabilities so that it can Organizations can develop a long-term programs and quantifying a wide range help manage the full suite of risks to plan for risk function development, and of risk exposures. They are doing this which the sector is exposed. There is manage compliance using a centralized by integrating operations and capital zero tolerance for safety risk incidents, approach. This combination can enable projects teams, to avoid a difficult which can impact a company’s license companies to leverage the compliance hand-off, where crucial information to operate. Reputation risk management demands of regulators to create new about threats on the ground can be lost. is of growing importance as energy risk function capabilities—such as and utilities companies undertake operational risk management—that 4. Focus on the “human business in the eye of social media current market pressures demand. and unconventional pressure groups. element” of risk Regulations such as anti-bribery laws Somewhat surprisingly, one of the impact front office and business greatest obstacles to successful development processes. If the risk deployment of risk analytics reported by management function is to play the our survey respondents relate to human greater role expected to address these resources. Some companies treat risk threats, it may benefit from close focus as a people game. They take up these on capabilities beyond the traditional risk staffing challenges through well- area of energy trading and develop developed recruitment and retention capabilities to address operational risks. programs and by providing training, including rotating risk staff into other business areas.
24 Defining “operational risk”
Operational risk is the risk of potential loss related to system, people, legal, and external events due to:
1. Internal risks (non-physical), arising from the people, processes, and systems, particularly risks related (but not limited) to trading operations. Losses can be qualitative (e.g., damage to reputation) or financial (e.g., financial losses caused by fraud or a rogue trader).
2. Physical risks (of energy commodities), arising from operations around production, delivery, and storage. Losses can be qualitative (e.g., damage to reputation) or quantitative (business disruption losses associated with missed production). These risks include production risks and hazard risks.
3. External risks (risks not within the bounds of one company), arising from legal, regulatory, political, and environmental exposures. Losses can be qualitative (e.g., damage to reputation) or quantitative (e.g., trades that result in financial loss).
Risks in categories (1) and (3) are most often referred to as operational risks. Risks in categories (2) and (3) are increasingly referred to as operations risks.
25 References
1 Accenture, “Global Risk Management Study 2013: Risk management for an era of greater uncertainty.” September 2013. Accessed at: http://www.accenture.com/ globalriskmanagementresearch2013
2 Accenture, “Developing Strategies for the Effective Delivery of Capital Projects: Accenture global survey of the energy industry.” June 2012. Accessed at: http://www.accenture.com/us-en/ Pages/insight-capital-projects-global- survey-energy-industry.aspx
26 Acknowledgements
We would like to thank the senior executives with global organizations who took part in our qualitative interview discussions and participated in our survey. We are grateful for the inputs of senior staff at each of these organizations, including: • BP • Eletrobras • Hess • RWE AG • Tractebel
We would like to thank the following senior leaders from Accenture who provided expert direction on the research, and insight on the issues covered: • Sander van ‘t Noordende, Group Chief Executive, Management Consulting at Accenture • Steve Culp, Managing Director, Accenture Risk Management
Thanks to the following Accenture executives, who contributed ideas and guidance to this energy and utilities sector-specific supplement. • Shelley Hurley • Margarita Jannasch • Ben Cattaneo • Philippe Herschke
27 About Accenture About Accenture Management Consulting Accenture is a global management consulting, technology services and Accenture is a leading provider of outsourcing company, with approximately management consulting services 266,000 people serving clients in worldwide. Drawing on the extensive more than 120 countries. Combining experience of its 16,000 management consultants globally, Accenture unparalleled experience, comprehensive Management Consulting works with capabilities across all industries and companies and governments to achieve business functions, and extensive research high performance by combining broad on the world’s most successful companies, and deep industry knowledge with Accenture collaborates with clients to functional capabilities to provide help them become high-performance services in Strategy, Analytics, Customer businesses and governments. The company Relationship Management, Finance & generated net revenues of US$27.9 billion Enterprise Performance, Operations, Risk for the fiscal year ended Aug. 31, 2012. Its Management, Sustainability, and Talent home page is www.accenture.com. and Organization. About Accenture Risk Management Accenture Risk Management consulting services work with clients to create and implement integrated risk management capabilities designed to gain higher eco- nomic returns, improve shareholder value, and increase stakeholder confidence.
For more information on the Accenture 2013 Global Risk Management Study please visit www.accenture.com/ globalriskmanagementresearch2013
This document is intended for general informational purposes only and does not take into account the reader’s specific circumstances, and may not reflect the most current developments. Accenture disclaims, to the fullest extent permitted by applicable law, any and all liability for the accuracy and completeness of the information in this document and for any acts or omissions made based on such information. Accenture does not provide legal, regulatory, audit, or tax advice. Readers are responsible for obtaining such advice from their own legal counsel or other licensed professionals.
Copyright © 2013 Accenture All rights reserved.
Accenture, its logo, and 13-2412 High Performance Delivered are trademarks of Accenture.