THE LINK BETWEEN RISK MANAGEMENT, CRITICAL CONTROLS & AUDITING
John Wolfe Partner
Kim Chanel Vallée-Séguin Communications Manager
Webinar Objectives
✓ To share knowledge and perspectives about operationally excellent management systems and the essential role that risk management and auditing critical controls play in operational excellence
✓ To share the Nimonik passion for developing a compliance plus culture
60% of all operational losses result from preventable causes
80% of incidences are repeat issues
25-30% of an organization’s costs this year will be wasted fixing the same issues
*Source: Peter Merrill – Do it Right the Second Time
Operational Risk Management and Audit – A Safety Moment
5
“Those who don't know history are destined to repeat it.”
- Edmund Burke
“You cannot find what you do not seek” - St. Paul
A Few Wise Words
In my experience the organizations with robust integrated ISO 9001, ISO 14001 – OHSAS 18000 HSEQ management programs that also employ Six Sigma Lean management programs are the most successful. Why?
They go beyond simple regulatory compliance ✓ They understand their risks and opportunities ✓ They understand their processes ✓ They have simple up-to-date procedures that they follow, they have competent staff and contractors, the right metrics ✓ They empower their people ✓ They focus initially on HSE bad actors, waste, first time quality, energy efficiency – building a base for continual learning and improvement ✓ They audit – a lot
Management System Framework
1. Leadership, Integrity & Accountability 2. Risk Identification, Assessment &
Management 3. Legal Requirements & Commitments 4. Objectives, Targets and Planning 5. Management of Change
6. Structure, Responsibility & Resources 7. Training & Competence 8. Facilities Design & Construction 9. Operations & Maintenance Controls 10.Contractor Management & Third Party
Services 11.Data & Document Management 12.Emergency Preparedness & Response 13.Information & Communication Management
14. Quality Assurance 15. Incident Reporting, Investigation & Learning 16. Operations Integrity Monitoring, Audit & Assessment 17. Corrective & Preventative Action
18. Stewardship & Management Review
PLAN
ACT
CHECK
DO
Regulatory Compliance
• Create a Legal Registry that identifies all your legal and
other requirements
• Create processes (including audits) to verify compliance
status
• At a minimum - operate within compliance requirements
• Have a compliance plus philosophy where it adds value
and a robust risk management process
Sample – Legal RegistryTracking Location Permit Description Dates Documents & Filing Compliance Turnover
ApprovalRegistryNumber
Approval Type
Priority / Tier
Project Area Plant
Sub-Plant
System / Tag Number
Legal Land Description
Approval Issuer
Approval Name / Title Description
Person Responsible
to Obtain Approval
Activity for which Approval
is Required
Forecast / Actual Date to Submit Appl'n
Appoval Turn
Around Time (days)
Forecast Date
Approval Required
Actual Date
Approval Received
Permanent /
Temporary (expiry date)
Renewal
Required (Y/N)
Operating Controls
(reference documents)
Oil Sands Legal
Registry(hyperlink)
Approval Application (hyperlink to Livelink)
Approval Number and Hyperlink to
Livelink
Compliance Document
(descriptor, or hyperlink to
Livelink)MPG Compliance
Status
Ultimate Approval Owner Notes
At a minimum: ✓ What is the requirement?
✓ How, why and where is it applicable in your operations?
✓ Who is responsible for demonstrating compliance?
✓ What evidence do you have?
✓ If monitoring and reporting are required - who looks after it and at what frequency
Lots of good examples – Suncor had 30 plus data fields
The Risk Management Framework
Communicate & TrainCommunication
ReportingTraining
Communicate & TrainCommunication
ReportingTraining
Risk Structure & Accountability
Risk Roles & Responsibilities:Executive Leadership Team
Chief Risk OfficerBusiness & Function Leaders &
Management
Risk Structure & Accountability
Risk Roles & Responsibilities:Executive Leadership Team
Chief Risk OfficerBusiness & Function Leaders &
Management
Mandate & CommitmentPolicy
StandardsProcedures/Guidelines
Mandate & CommitmentPolicy
StandardsProcedures/Guidelines
Measure, Review & ImproveControl Assurance
PolicyStandards & Guidelines
KPI’sKRI’s
Measure, Review & ImproveControl Assurance
PolicyStandards & Guidelines
KPI’sKRI’s
Co
mm
un
icate
an
d c
on
su
ltC
om
mu
nic
ate
an
d c
on
su
lt
Establish the contextEstablish the context
Identify risksIdentify risks
Analyze risksAnalyze risks
Evaluate risksEvaluate risks
Treat risksTreat risks
Risk management information to action
- Risk Assurance - Risk Registers- Treatment Plan - Reporting Templates
Mo
nito
r an
d re
vie
wM
on
itor a
nd
rev
iew
Strategic Process
(Framework continuous improvement cycle)
Strategic Process
(Framework Implementation)
Strategic Process
(Framework Implementation)
Strategic Process
(Framework continuous improvement cycle)
Tactical Process
Risk assessment
Process for Managing Risk
1.
2.
2a.
2b.
2c.
3.
4. 5.
Figure 1. Risk Management Framework
IV.
I. II.
V. III.
Risk Management Framework --Adapted from CAN/CSA –ISO 31000–Q31001-11
Risk and Decision Making
The concept of risk includes five components:
1. Hazard inherent in an activity otherwise deemed
beneficial
2. An undesirable event, which brings out the hazard
3. Adverse consequence of the undesirable event
4. Uncertainty of whether the undesirable event will
happen or not (likelihood/ probability/ frequency)
5. Perception about the combination of the above
Definition of Risk
Issues/ “Hazards”
Undesirable event
Consequences
Risk
Likelihood of Consequences
Layers of Protection - Prevention
Layers of Protection - Mitigation
Causes
13
L i k e l i h o o d C a te g o ry - F re q u e nc y G u i d e l i n e s (B u si n e ss U n i t B a si s) D e sc r i p ti o n
f > = 1 / y rO c c u rs o n c e o r m o re p e r y e a r in B U / fa c i l i t y / p ro je c t , a n d is l ik e ly t o re c c u r w it h in o n e y e a r
6 III II I I I I
0 . 1 = < f < 1 / y r(b e t w e e n 1 / y r a n d 1 / 1 0 y e a rs )
E x p e c t e d t o o c c u r s e ve ra l t im e s in t h e B U / fa c i l i t y / p ro je c t l i fe t im e 5 III III II I I I
0 . 0 1 = < f < 0 . 1 / y e a r (b e t w e e n 1 / 1 0 a n d 1 / 1 0 0 y e a rs )
E x p e c t e d t o o c c u r in t h e B U / fa c i l i t y / p ro je c t l i fe t im e 4 IV III III II I I
0 . 0 0 1 = < f < 0 . 0 1 / y e a r (b e t w e e n 1 / 1 0 0 a n d 1 / 1 , 0 0 0 y e a rs )
M a y h a p p e n le s s t h a n o n c e d u rin g t h e B U / fa c i l i t y / p ro je c t l i fe t im e 3 IV IV III III II I
0 . 0 0 0 1 = < f < 0 . 0 0 1 / y e a r (b e t w e e n 1 / 1 , 0 0 0 a n d 1 / 1 0 , 0 0 0 y e ars ) *R e m o t e c h a n c e o f h a p p e n in g *2 IV IV IV III III IIf < 0 . 0 0 0 1 / y e a r ( le s s t h a n 1 / 1 0 , 0 0 0 y e a rs ) *E x t re m e ly re m o t e c h a n c e o f h a p p e n in g *1 IV IV IV IV III III
*N o t e : L ik e l ih o o d c a t e g o rie s 1 & 2 a re t y p ic a l ly fo r fa c i l i t y d e s ig n p u rp o s e s C 1 C 2 C 3 C 4 C 5 C 6
So
cia
l In c id e n t - n o T re a t m e n t
F i rs t a id / m in o r i l l n e s s
M e d ic a l a id , in ju ry o r i l l n e s s / re s tr i c te d w o rk / N u is a n c e p u b l ic im p a c t
T e m p o ra ry d is ab i l i ty/ lo s t tim e /
P e rm a n e n t d is a b i l i ty/ fa ta l i ty/
M u l tip le o n -s i te fa ta l i tie s /
En
vir
on
me
nta
l
R e le a s e to o n -s i te e n vi ro n m e n t, c o n ta in e d im m e d ia te ly
S m a l l u n c o n ta in e d re le a s e b e lo w le g a l l im i t o r w i th m in o r im p a c ts / p o s s ib le c u m u la tive im p a c t o n -s i te
M in o r e n vi ro n m e n ta l im p a c t, b u t re s u l t in p e rm i t vio la tio n o r a d m in is tra ti ve p e n a l tie s
S ig n i fi c a n t a d ve rs e im p ac t, s ig n i fi c a n t lo n g- te rm l ia b i l i ty, e n fo rc e m e n t a c tio n
C a ta s tro p h ic im p a c t, m a te r ia l ( c o rp o ra te ) lo n g -te rm l ia b i l i ty
Ec
on
om
ic
C < $ 1 0 k $ 1 0 k = < C < $ 1 0 0 k $ 1 0 0 k = < C < $ 1 M $ 1 M = < C < $ 1 0 M $ 1 0 M = < C < $ 1 0 0 M
C > $ 1 0 0 M
So
cia
l
In d ivid u a l c o n c e rn / lo c a l m e d ia a tte n tio n / n o im p a c t o n S u n c o r 's re p u ta tio n
C o m m u n i ty c o n c e rn / re g io n a l n e w s / a d ve rs e im p a c t o n S u n c o r 's re p u ta tio n a t re g io n a l le ve l
P ro vin c ia l n e w s / a d ve rs e im p a c t o n S u n c o r 's re p u ta tio n a t p ro vin c ia l / s ta te le ve l
N a tion a l n e w s / p u b li c o u tra g e / s h o rt- te rm d ro p in m a rke t s h a re a n d s h a re p r ic e
R e c u r r in g n a tio n a l a tte n tio n / p u n i ti ve a c tio n b y g o ve rn m e n t a g a in s t c o m p a n y/ lo n g - te rm m a jo r im p a c t o n m a rk e t s h a re a n d s h a re p r ic e
F i n a n c i a l / D a m a g e (E q u i p m e n t + B u si n e ss I n te r ru p ti o n ) (B u si n e ss U n it/ C l i e n ts)
H e a l th & S a fe ty (P u b l i c a n d E m p l o y e e s)
In c r e a s in g C o n s e q ue n c e
Lik
elih
oo
d C
ate
go
ry
R e p u ta ti o n (P o l i ti c a l / R e g u l a to ry )
Inc
rea
sin
g L
ike
lih
oo
d
C o n s e q u e n c e C ate g o ry
E n v i ro n m e n ta l
Action PrioritiesResidual R isk Leve l Action Priority
I
II
III
IV Em ployees and contrac tors are aware of the risk , and follow es tablished procedures
Respons ible EVP & CEO to be m ade aware of risk , along with mitigation and risk reduction plansBus iness Unit EVP is respons ible to obtain approval from CEO for continued operation
Respons ible VP ensures preventive controls and m itigation plans are es tablished and m aintained, and risks are re-assessed at appropriate intervals
Operations m anagem ent m onitors the risk , ensures preventive controls and m itigation plans are func tioning and procedures are followed
Suncor Risk Matrix
• A Risk Map thus provides a means of ranking the risk of events relative to each other and also providing guidance for action levels
III II I I I I
III III II I I I
IV III III II I I
IV IV III III II I
IV IV IV III III II
IV IV IV IV III III
Consequence C
Like
lihoo
d L
Individual Event Types
• For different events that we identify through a risk analysis, once we also know their consequence C and likelihood L, we can plot them on a graph
Presentation of Risk - Risk Maps
Integrated Risk Analysis Methods
Hazard Identification Methods
• Brainstorming
• Field Level Risk Assessment
• Job Safety Analysis/ Task Analysis
• What-if
• HAZOP
• FMEA
Bow-Tie Risk Analysis
RISK
EVENT
Preventivecontrols
Reactivecontrols
Causes
Causes
Causes
Consequence
Helping to ensure that risks are managed rather than just analyzed
Consequence
Consequence
Preventivecontrols
Reactivecontrols
THREATS
PREVENTIVE CONTROLS
Governance and Oversight •Policies and procedures •Delegation of authorities •Functional segregation of duties •Continuous Improvement mindset
Approval of Vessels •Marine technical expertise and experience •Marine Risk Management System (IT tool) •Consistent vetting process and rules •Vessel Acceptance Report issuance •Document administration
Tools and Processes •AQUARIUS IT tool data management •Cargo handling instructions •Loss Control • IT general controls (disaster recovery, backup of AQUARIUS, internally hosted) •vessel tracking -Capturing of contract terms
Compliance and Benchmarking •Meet applicable legal requirements •Consistent with best industry practice •Compliance with company X Vessel Selection Criteria
Information Technology Management •Marine Risk Management System (MRMS) IT tool •MRMS data and documentation retention
Financial Management •Volume actualization •Logistic settlement •Counter-party / broker settlement •Exchange settlement •Invoice management (include netting) •A/R and A/P management •Demurrage and cargo claims •Loss control •Tariff validation
CONSEQUENCES
RECOVERY CONTROLS
MARINE TRANSPORTATION
Reputational • Public outcry from Oil Spill • Investor confidence/Share price
(shareholders)
Operational • Crude supply to refineries affected
Financial • Cost of Cleanup • Insurance Deficiency • Impact from Refinery shut- down
Legal and Regulatory • Fines and sanctions • Lawsuits • Prosecution of Executives
Strategic • SEMI Growth Objectives • Impact on other major initiatives
due to residual reputational damage
Strategic -Misalignment with current and future company strategy and risk tolerance
People •Skills/experience of staff •Workforce demographics
Roles & Responsibilities •Marine accountability for transportation vs. contractual agreement made by operating groups
Environmental and Reputational •Operating business units non-compliance •Employment of sub-standard vessels •Engagement of unapproved vendors •Geographic operating environment •Inadequate insurance coverage •Public Perception – •Readiness to respond to a major event •Increasing Environmental consciousness
Assets •Use of Aging Fleets/infrastructure
Commercial •Commercial needs are not aligned with company’s risk tolerance •Inadequate insurance coverage •Structured deals •High cargo volumes •High dollar values •Freight market volatility •Cargo quality and Loss Control
Unsafe (release of Petroleum Product
in Waterway) or non-compliant transportation
activity
Core Business Objectives: 1.Safe, efficient, regulatory compliant movement of crude and products transportation on water)
Who is the Client: Marine Transportation, other stakeholders involved in or supporting marine transportation activities.Risk Analysis
Financial •Commercial and market expertise • competitive commercial advantage •Centralized market knowledge •Cost controls (GOA/CA limits)
Risk Management •Major Emergency Team process •Marine Dept people and processes •Corporate Public Relations process •Internal and External Legal support •Corporate Charterers Liability Insurance
▲No material findingsGrayed out: excluded from scope based on planning meetings
◄ Process improvement or increased formalization
▼ Gap or control failure warranting attention
Key:
II
IIII
III
III
IIIIIIIII
II
I
Current State Future State Current State Future State
Governance and Oversight •Marine policy should be a company X PG&S •Identify all stakeholders •Marine policy improved by appropriate level of company X executive management •Appropriate individual responsible for updating and maintenance of policy •Formalized process for communicating Marine policy
Marine Department Procedures •Formalized procedures should be documented
Tools and Processes •AQUARIUS / MRMS systems should be documented •Formal documented guidance provided to users
East Coast •Formalized communication channels with Marine department •Update East Coast Marine procedures •Compliance to policy •SCM Logistics group interaction with marine group
BC Terminal •Formalized communication channels with Marine department •Use of TSW
RR
RL= Risk Level RR= Residual Risk
RLII
II
IIII
II
III
IIII
Emergency Response Procedures •EH&S and Terminal spill procedures •Spill reporting/control procedures
SIG
NIF
ICAN
T RI
SK
RECOVERY MEASURES
Unplanned Event
Emergency Condition
CON
SEQU
ENCES
Risk
Ass
essm
ent
Elem
ent 2
Proc
ess
Haz
ard
Anal
ysis
Man
agem
ent o
f Ch
ange
s
Com
pete
ncy
Pro
gram
Engi
neer
ing
Cont
rols
Stan
dard
, Pro
cedu
re,
Gui
delin
e
Cont
ract
or S
elec
tion
Cont
ract
or P
erfo
rman
ce
Stak
ehol
der C
once
rns
Com
plia
nce
Task
s
Less
ons
Lear
ned
Emer
genc
y Re
spon
se
Inci
dent
Inve
stig
atio
nRo
ot C
ause
Ana
lysi
s
Goa
ls a
nd T
arge
ts
Man
agem
ent o
f Cha
nge
Risk
Ass
essm
ent
Deci
sion
Mak
ing
Auth
ority
PM P
rogr
ams
Haz
ard
Repo
rtin
gN
ear M
isse
s
Tren
ding
& A
naly
sis
Elem
ent 3
Elem
ent 4
Busi
ness
Pla
ns
Elem
ent 5
Elem
ent 6
Elem
ent 7
Elem
ent 9
Elem
ent 1
0
Elem
ent 1
2
Elem
ent 1
3
Emer
genc
y Pl
ans
Elem
ent 1
5
Elem
ent 1
2
Elem
ent 1
5
Elem
ent 1
7
Elem
ent 5
Elem
ent 1
2
PREVENTIVE BARRIERS
OEMS
Risk and Control based audits will audit both preventative and recovery control adequacy and effectiveness using OEMS criteria
End Result of a Risk Assessment
• “Risk Inventory” or “Risk Registry”
• Risk assessments are “integrated” risk assessment
• Risk assessment worksheet to record the results in summary form.
HAZOP worksheet in Stature
21
Hazard Controls
Last resortPersonal Protective Equipment (PPE):the least effective way to protect workers. If the PPE fails, the workers are exposed
to the hazard.
Engineering Controls:Separate: Isolate the hazard by guarding or enclosing Redesign: Change a process or reconfigure equipment
Substitute: Replace materials or processes
Administrative:changing the way workers do their jobs,
changing policies and procedures for safe work practices, training, etc.
Most effective to least effective
The Hierarchy of Hazard Controls
Control of hazards starts at the top and works down with PPE being the last line of defense.
Figure 1: The Hierarchy of Controls: a method for determining appropriate Operational Controls.
Eliminate the hazard:Completely remove the hazard
Cost/Benefit Analysis
Dynamics of an Incident
System 1
System 2
System 3
System 4
System 5
System 6
System 7
“Hardware” Defenses - Process design - Plant layout - Protection systems
“Software” Defenses - Procedures - Audits - Management systems
“Liveware” Defenses - Safety culture - Motivation - Alertness
Unusual conditions
Latent failures in systems
Incident
Deepwater Horizon
Incident and KPI Analysis
Major Operational Risks and Control Review
Strategy and Values -Emerging EHS and PS Risks
OEMS Self Assessments & Audits
Coverage - Prior Audits & Assessments
Audit and Assessment Planning
Audit Scope Value Proposition
Management Consultations
Principal Risks Suncor Strategy & Value Drivers
Audit Plan
Idea Generation & Project Scoping
Coverage Over Time
Resourcing
Risk, Value, OEMS Alignment
Prioritization& Selection
Prior Audit Insights External Risks
• 5 Year Audit Plan Established • Process Audit Approach
OEMS Audits – Non Hazardous Operations / Functions
• Embedded into OEMS Process Audits • Process Hazard Analysis • Mechanical Integrity • Quality Assurance
OEMS Audits – Hazardous Operations • Annual Determination of Targets
• Significant Risks / Key Controls • Environmental • Safety (Personnel and Process) • Emerging Risks • Business Process Effectiveness • Compliance
Risk- Based Audits
Planning Process
In-Year High Risk Requests
Process Improvement Project GRC implementation
Continuous Improvement
Audit Area DescriptionProposed Timing
ENTERPRISE ASSESSMENTS (Potential impact based on Scope of Audit)
Facility Siting Organizational assessment of conformance to the company X 2110 Standard on Facility Siting requirements. Review of status of studies, API and SU 2110 requirements, reporting, risk management, mitigative actions and budgeting
TBD
Risk Transparency Risk Transparency / Efficacy of Ranking & Reporting RRI and RRII identification, assessment, monitoring and reporting requirements. company X Standards and Process support effective risk transparency and governance of high risk exposures identified by the organization. (Including and internal review of past incidents and risk ranking/reporting)
TBD
Pipeline Integrity Non-Regulated Lines
Process Pipelines Compliance, Conformance to Standards and Risk Management Assessment of compliance against regulatory requirements and conformance against related corporate standards.
TBD (Western Canada)
Decommissioned Equipment
Operational excellence; policies, standards, procedure review of decommissioned equipment processes utilized throughout the organization.
TBD
Contaminated Sites Liability
Compliance, Conformance and Risk Management Assessment of compliance against regulatory requirements and conformance against related corporate standards.
TBD
Capital Allocation Process (Joint with IA)
Capital Allocation and Risk Management Assessment of current capital allocation process and risk management/mitigation of projects identified by the business to mitigate RRI and RRII items.
TBD
Critical Equipment Back-up
Critical Equipment and Exposure to Significant Operational Outages Targeting of assets that if taken offline (e.g. external threat / incident) could lead to a significant operational outage. How exposed are we on certain systems and what security exists to protect identified critical assets.
TBD
Contractor Management TBD
Risk Management Process design effectiveness review to mitigate company X Contractor Management risks. Scope to be determine with IA.
TBD
Audit Plan - Summary
Auditing of Critical Controls
• Minimize impact on operations because of limited resources
• Focus on efficacy
• Start with Level 1 inherent risk
Auditing of Critical Controls
• All audit programs have limited resources, and need to minimize their impact on operations
• It is therefore important to focus efforts on providing assurance that the controls used to prevent incidents with the highest consequences are operating with efficacy
• I suggest you start with your level I inherent risk controls and work your way down the food chain – recognizing that the front line risk and control owner have the ultimate responsibility and in an ideal world should already have said data and you are simply confirming it
31