Executives at Kuwait Petroleum Corporation report exclusively for Oil & Gas Middle East on their adoption of enterprise risk management
The oil and gas industry is famously traditional in its business practices and can be slow to adapt to the possibilities offered by changing technology and management techniques.
Ours is an uncertain world, and many organisations fear adding to this by making changes of their own, even when these changes may be needed to recognise and cope with the next wave of business risks and rewards.
Not so at Kuwait Petroleum Corporation (KPC), the national oil company responsible for the entire Kuwaiti oil and gas sector, which has been implementing a new form of risk management which its executives say has the power to change how the industry works for the better.
Risk Evolution
“In the oil and gas industry, we see a genuine evolution,” explains Iman Al-Gharabally, team leader for enterprise risk management at KPC. “Especially in recent years, enterprise risk management (ERM) has come to be defined as the capacity to harness corporate risk intelligence to enhance business performance and deliver on a successful business strategy.”
Bader Al-Shumaimri, corporate risk manager at KPC, says ERM has been increasingly embraced by leading organisations as a distinctive value preservation driver, performance differentiator and enhancement proposition. “Originally, risk management was thought to be essentially negative,” he explains. “If nothing was going wrong and you met the compliance standards set for you, risk management was thought to be ticking along successfully.
“ERM has evolved from this narrow view to embrace more systematic risk reduction, taking into account both KPC’s strategic objectives and the associated opportunities for reward.”
Al-Gharabally says that a combination of accidents – chiefly the Macondo blow-out and spill – riskier drilling – such as Shell at Sakhalin – and a slew of commercial and organisational risks involved in the region’s lump-sum turnkey mega-projects are driving a change in risk management approaches, spearheaded by IOCs. The trend is moving away from ‘simple’ compliance in areas such as HSE and towards a systemic approach.
“Faced with managing the relative fragility of their cash flows, often sharper risk profiles and increased global economic volatility, IOCs have been at the forefront in the pursuit of meaningful and effective enterprise wide risk management,” says Al-Shumaimri. “Now, National Oil Companies (NOCs) are embarking on a similar journey.”
Interestingly, many NOCs not only face similar challenges as their publicly-traded counterparts but also encounter new or unique risks. These include pursuing more international projects; meeting growing demands to provide revenue for increasing governmental spending on social and infrastructure projects; and responding to human resource shortages, mounting supply and procurement costs as well as availability issues.
“The starting point was to remind ourselves of what a NOC is there for,” explains Tony Milsom, risk management specialist at KPC. “At KPC we aim to maximise domestic hydrocarbon development and deployment, while providing the essential financial resources to fund Kuwait’s development priorities. Our approach to risk flows from these objectives.”
“From what we have witnessed, many NOCs often lack the tools to convert their risk profiles into real insights,” reveals Al-Shumaimri. “To create this required risk transparency, NOCs may consider ‘Cash Flow at Risk’ modeling (Exhibit 3). Such a tool helps to translate major risks into full economic impacts on an NOC’s financial statements.”
Al-Shumaimri emphasises that KPC is in the early stages of a multi-year journey to implement a full ERM program across its businesses. ERM requires plenty of changes from staff training to information management (see boxout).
Despite the challenges, Al-Shumaimri is confident that the company is enthusiastic about these changes and what they can bring to the highest levels of KPC’s businesses.
“ERM has already allowed KPC to define its enterprise risk profile and refocus management attention on its critical business exposure. We’ve distilled the hundreds of risks identified by KPC into a short-list of enterprise risks to be closely managed by the top level of the company. It has helped management and the Board to focus their full attention on the critical business continuity risks that could hamper our economic mission.
“We strongly believe that foresights into the impact of such enterprise-class risks, which have the potential to severely affect NOCs’ ability to meet their objectives, will help NOCs to continue delivering on their essential role for the State, and in KPC’s case, better than ever before,” concludes Al-Shumaimri.
“Expand upstream or downstream? Expand at home or abroad? Invest or conserve capital? ERM will make a significant contribution to improving decision-making in the years ahead,” says Milsom. “It will greatly enhance decision-making on KPC’s projects and overall portfolio, most notably in striking the balance between various growth options with radically different risk-return profiles.”
The prize – optimum service to Kuwait – makes this hard work worthwhile.
Article continues on next page …
Bader Al-Shumaimri, CORPORATE RISK MANAGER AT KPC, explains the steps involved in implementing ERM
ERM is a multi-year program that reaches beyond traditional, compliance-focused efforts. It can be broken down as follows:
• First, corporations need to create risk transparency. At this stage, systematic risk identification and reduction measures are our focus. We will require significant new infrastructure to bring this about.
• Once we have transparency, likelihood and impact of downsides and upsides need to be assessed and potential mitigation measures evaluated.
• Finally, our risk processes need to be enhanced to translate early warnings into active risk management. We will also begin embedding risk optimisation into every strategic decision KPC makes. Our governance and risk management structures will be re-designed to utilise and exploit the results.
Clearly, ERM is about active change. To succeed, managers must understand that an active risk management approach has the potential to create business value, rather than viewing it as a compliance-focused and burdensome exercise.
To demonstrably contribute to value creation, big risks need to be flagged up front. KPC’s leaders need to be engaged by “real numbers” that quantify potential impact. We also need to foster the idea that ERM will speed and improve decision-making, not slow it down with compliance issues.
Both processes and systems have to be properly designed to ensure that executives focus on the highest impact risks. Training is also a critical element.
