maximizing value from technical (operational) audits...

Internal Audit, Risk, Business & Technology Consulting

MAXIMIZING VALUE FROM TECHNICAL (OPERATIONAL) AUDITS IN OIL AND GAS November 30, 2016

© 2016 Protiviti Member Firm for the Middle East Region CONFIDENTIAL – This document is for your organization’s internal use only and should not be copied or distributed to any third party.

TABLE OF CONTENTS

2

01 Technical Audits What is Internal Audit? Internal Audit Key Activities Technical Audits – An Introduction Case Studies – Value Maximization through Technical Audits

TECHNICAL AUDITS What is Internal Audit?


WHAT IS INTERNAL AUDIT?

The role of internal audit is to provide independent assurance that an organization's risk management, governance and internal control processes are operating effectively.

Internal auditors deal with issues that are fundamentally important to the survival and prosperity of any organization. Unlike external auditors, they look beyond financial risks and statements to consider wider issues such as the organization's reputation, growth, its impact on the environment and the way it treats its employees.

4

Introduction


WHAT IS INTERNAL AUDIT?

5

Establishment of a formal internal audit function for assurance to management was started to be seen as a logical answer.

Internal audits not just limited to financial and compliance – Performance, Projects, etc.

Broadening of Internal Audit’s role in the services to management (such as compliance and quality)

Establishment of IIA and statement of responsibilities of an Internal Auditor

1. Performance measurement of internal audit departments

2. Planning, Fieldwork & Reporting

Internal Auditors with specialized industry backgrounds – Oil & Gas, Technology, etc.

1 2 3 4 5 6

1910s

Evolution of Internal Audit

The origin of auditing goes back to times scarcely less remote than that of accounting. Whenever the advance of civilization brought about the necessity of one man being entrusted to some extent with the property of another, the advisability of some kind of check upon the fidelity of the former would become apparent.

1940s

1960s 1990s

1970s 2000s

TECHNICAL AUDITS Internal Audit Key Activities


IIA's Standards for the Professional Practice of Internal Auditing - The internal audit activity plan of engagements must be based on a documented risk assessment, undertaken at least annually. Reasons for updating risks are:

• Changes in Organizational Structure

• Changes in the Controls

• Changes in Business Objectives

• Change in Market Dynamics

• Audit Findings

Risk Refresh

INTERNAL AUDIT KEY ACTIVITIES

7

Follow-up on Corrective Actions

IIA's Standards for the Professional Practice of Internal Auditing - The internal audit activity plan of engagements must be based on a documented risk assessment, undertaken at least annually • Inherent Risk Assessment • Controls Validation • Residual Risks Assessment • Audit Universe Establishment • Development of IA Plan

IIA's Standards for the Professional Practice of Internal Auditing - The chief audit executive must ensure that internal audit resources are appropriate, sufficient, and effectively deployed to achieve the approved plan

IIA's Standards for the Professional Practice of Internal Auditing - Internal auditors must develop and document a plan for each engagement, including the engagement’s objectives, scope, timing, and resource allocations. They must also identify, analyze, evaluate, and document sufficient information to achieve the engagement’s objectives.

• Planning

• Fieldwork

• Reporting

• Closeout

IIA's Standards for the Professional Practice of Internal Auditing - Chief audit executive should establish a follow-up process to ensure that management actions have been effectively implemented or that senior management has accepted the risk of not taking action

• Target dates recording of agreed action plans

• Evaluation of Management’s Responses

• Verification of Responses

• Follow-up for additional information, if required

• Escalation mechanism for unsatisfactory responses

• Obtaining revised implementation dates process

Provide Assurance through IA execution Risk Assessment

Risk Refresh

Follow-up on Corrective Actions

Provide Assurance through IA execution

Risk Assessment

Knowledge Sharing Communication Continuous Improvement

Internal Audit challenges current practice, champions best practice and acts as a catalyst for improvement, so that the organization as a whole achieves its strategic objectives.


INTERNAL AUDIT KEY ACTIVITIES

Based on your historic (last 5 years) assessment of your organization’s risks and the Internal Audit Plans in place in your organization, kindly list down your top 5 (actively managed) auditable areas.

8

Internal Audit Plan

Support Services Audit Technical Audits

IT Audits Ad Hoc Assignments

Non-technical Audits

HR

Finance Procurement & Contracts General Services

Application Support

Infrastructure

Security

General Controls

Logistics

Warehouse

Material

Management

Planning & Control

Health Checks

Investigations

Drilling

Maintenance

HSE

Marine Services

Refinery Operations

TECHNICAL AUDITS Technical Audits – An Introduction


TECHNICAL AUDITS – AN INTRODUCTION

10

Focus Areas for Middle East Oil and Gas Business

Meeting Expectations

Finance Audit Procurement Audit

Project Management Audit

Exceptional

Audits focusing on: • Operations reliability,

efficiency and effectiveness • Technical competency

assessment • Audit of new technology

proposed

Stated Industry Requirements The Real Objective Overall Value

The Real Problem

Redefining and redesigning the company’s core strategies to be competitive in

current scenario and at the same time

containing risks within ALARP

levels

Greater Context

Progress to be in line with changing competitive landscape

Mechanisms

Substantial investments in advanced technologies SMART KPIs

Risks

Failure to adopt Failure of technology

Incorrect reporting

Mitigation Measures

Strong Internal Controls frequently tested and reported by Internal Audit

Stated Need

• Assimilating & Exploiting Advanced Technologies

• Accelerating Asset Development

• Improving Operational Reliability, Effectiveness and Performance Management

• Enterprise Risk Management

• Investments and Capital Projects

• Creating Local Capabilities and Opportunities



11

Effectiveness & efficiency of operations

Profit maximization • Defined ‘Vision’ of the company • Business Plan and Business

Strategy • Business Process Risk

Management • External & Internal Audits • Policies & Procedures • Engineering & Technical Services • Defined ‘Key Performance

Indicators’

Accuracy of financial reporting

Adherence to quality standards

Safeguarding of assets

Return over investment (ROI)

Compliance with laws &

regulations

Achieve company’s mission & vision

Health, safety & environment Process Safety

Increase in Stakeholder and Business Assurances

Stakeholders Assurances

Business Assurances

Steps taken to achieve them…

Technical Audits ?



12

Do we have answers for…

Minimizing NPT and recovering NPT

losses from Contractors

Consistency & accuracy in accounting

assumptions of crude oil & products

Unsafe operating conditions and

compliance with Process Safety

guidelines

Periodic inspection and corrosion

monitoring of critical assets

Compliance with environmental

regulations for air emissions, effluent, ground water & sea

water Update of Reservoir Simulation model in

line with current geographic & plant

operating conditions

Accuracy and reporting of

identified (flaring, etc.) & unidentified

refinery losses

Increasing turnaround and

maintenance costs over the years

Refining Production &

Operations Audit

Process Safety Management Audit

HSEMS Audit

Maintenance Management Audit

Hydrocarbon Accounting Audit

Rig Operations Audit

Asset Integrity Management Audit

Reservoir Management Audit

TECHNICAL AUDITS



13

Technical Audits – Change in focus

Explore Interpret Drill / Appraise Develop – Produce - Maintain Refine Trade Transport

Operations Effectiveness

Production Optimisation (Production Efficiency)

Oilfield Services (SCM Improvement)

Energy Risk Management

Enterprise Performance Mgmt / Operations alignment

Operational Improvement (SCM to Demand Driven)

Reliability Maintenance (Asset Strategy)

Major Project Turnaround & Capital Investments

Enterprise Asset Management



14

Technical Audits – Generating Value

Time

Bene

fit

Continuous reduction in Gross Refinery Margins (GRM).

Inadequate controls to restrict unauthorized changes to refinery linear programming (LP) model.

Basis of inputs received by EPS from other departments (operations, trading etc.) is not standardized.

Improper monitoring of production activities may lead to financial loss Absence of quality check process may result in possible excess giveaway to customer leading to financial loss.

Work Stream Driven Examples of Risk in O&G

Inadequate preparation and maintenance of control room activity log books may result in absence of complete information for actions performed and authorized in previous shifts.

Non compliance to maintenance schedule of data acquisition equipment may delay data acquisition process. Absence of defined critical path may delay the data acquisition process.

Inadequate measurement and reconciliation of gas and liquid quantity supplied / invoiced to relevant receiver may result in high unidentified losses.

Short Term (Compliance)

Longer Term (Process Improvement) Total

Benefit

Technical audits penetrate through company’s core business processes to not just identify non-compliances or inadequate governance, but also long-term process improvement opportunities.

TECHNICAL AUDITS Case Studies – Value Maximization through Technical Audits


• Monitor and analyze flaring quantity from each flare stack periodically. • Define a standard maximum flaring quantity guideline from each offshore platform as done for onshore flaring (0.3%

of lean gas production). • Identifying root cause for instances with high flaring and high variations from routine flaring in platform P2.

Key Recommendations

CASE STUDIES Case Study I – Flaring on offshore platforms

16

Observation

The client had two offshore platforms for production of natural gas. Both platforms have similar operations. There were meters installed in flare stack of each platform to measure the flaring of pilot burner gas, purge gas and process gas. Pilot gas and purge gas were maintained at constant flow rate. We noted that: • There was no process to analyze the daily flaring quantity within a platform

and among the two platforms. • The average quantity of pilot and purge gas flaring from P2 platform was higher

than P1 platform average by 10% (40,000 SCFD) daily. • The quantity of pilot and purge gas flaring is constant each day on P1. However

there is inconsistency in rate of flaring for P2. The quantity of pilot and purge gas flaring varied with a standard deviation of 15,295 SCFD.

A large JV company based in Abu Dhabi with gas explorations and production operations in Qatar. Client produces, processes and transfers 2.2 BSCF gas to UAE per day. C

lient

Upstream Midstream Downstream Oil Gas

Operating Efficiency Business Continuity Financial Reporting Safety & Environment

Comparative Flaring Analysis (in MSCFD)

P1 Avg

P2 Avg


• Implement Standard Terms & Conditions for NPT in drilling contracts for avoiding any possible financial loss. • Identify and implement possibilities of including penalty / deduction clauses for contracts where NPT was not

applied previously. • Document the process for NPT monitoring and reporting.

CASE STUDIES Case Study II – Standard T&Cs for NPT in contracts

17

Observation

Non Productive Time (NPT) is the time elapsed between the non-conformances and returning back to the same position before the event occurred. It is the time spending to recover from the consequences of the incident. NPT only includes time where operations could proceed normally (e.g. waiting on weather is not included in NPT). We noted that: • There was no documented process for monitoring and reporting of NPT. • The standard terms and conditions in relation to NPT were not applied

consistently across all contracts. • Absence of a penalty clause for NPT in major service provider contracts that led to

potential loss (approx. AED 3.8 Million).

A large oil exploration company JV company based in Abu Dhabi operating 3 major offshore fields.

Clie

nt Upstream Midstream Downstream

Oil Gas


NPT Computation (Year 2010 to 2012)

Key Recommendations


• Calculate and report the year-end based on actual water content in storage tanks as on year-end date. • In instance of repetitive differences between ATG readings and manual dips across multiple months, the frequency

of correction of ATG reading with manual dips should be increased to weekly for specific tanks. • Analyze the hydrocarbon content in sludge each year. If possible the analysis should be conducted in the month of

December to improve the accuracy of year end stock estimation.

CASE STUDIES Case Study III – Stock accounting of Crude Oil

18

Observation

We noted an inaccuracy of 17,083 barrels in year end crude oil stock accounting for the year 2013. Following were the contributing process gaps resulting in incorrect crude oil stock calculation: • The water content in tank was considered based on manual dips measured in November 2013 and did not account for

quantity of water drained from tank in the month of December 2013. Incorrect estimation of water content in storage tanks as on 31 December 2013 resulted in underestimation of crude oil stock by 12,355 barrels.

• Uncorrected continuous difference between automatic tank gauge (ATG) and month end manual dip readings resulted in underestimation of crude oil stock by 4,727 barrels.

• There was no defined frequency for assessment of hydrocarbon content of sludge in the storage tanks. In the last 8 years, the sludge sample was analyzed for hydrocarbon content only 2 times. This may result in incorrect estimation of crude oil stock by 1,397 to (1,985) barrels.

A large oil exploration company operating in onshore and in shallow coastal water of Abu Dhabi. The company has mainly six oil fields and has production capacity of 3 million barrels of oil per day. C

lient



Key Recommendations


• Update the details of these new pipelines in pipeline inspection planning and monitoring application. • Conduct baseline inspection for these pipelines and develop asset integrity inspection plans. • Include the process of application update and asset integrity plan update as a part of project closeout procedure

for pipelines commissioning.

Key Recommendations

CASE STUDIES Case Study IV – Integrity Inspections of Pipelines

19

Observation

In January 2012, 2 new gas pipelines were installed in the UAE gas distribution pipeline network of the company. As per the Pipeline Inspection and Surveillance Procedure of the company baseline inspection was required to be conducted within 12 months of pipeline commissioning. We noted that: • It has been over 2 years the pipelines have been commissioned and taken in

operation however, the details of these pipelines were not present in the application which is used for planning and monitoring of inspections for pipelines.

• Subsequently, these pipelines were not included in asset integrity plans for visual inspections, ultrasonic testing, inline or outline inspection etc.

A large JV company based in Abu Dhabi with gas explorations and production operations in Qatar. Client produces, processes and transfers 2.2 BSCF gas to UAE per day. C

lient



Details of 2 New Pipelines Installed

Pipeline Diameter

Length of Pipeline Type

24 inch 425 m Above ground

18 inch 481 m Above ground


• Conduct physical inspection of all the tanks for verifying that isolation valves of storage tanks are working effectively.

• Monitor & record shift wise closing stock levels for tanks in static condition and highlighting to the Supply Division in case of significant difference observed in tank levels.

CASE STUDIES Case Study V – Dip in stock level of ‘Static’ Tanks

20

Observation

Supply Division provides the Daily Disposal Report to the Oil Movement section for storing the crude oil received and moving products in the Refinery as per requirement. Senior Operator manages all transfers online through Distributed Control System (DCS) from control room and provides instruction to field operator for isolation. Based on our review of hourly ATG readings of crude oil and product tanks for the month of December 2012, we noted following: • Difference in transferred Gas Oil quantity from intermediate tank to final product

tank in 4 instances in the range of -13 KL to 271 KL. • In 20 instances though the tank was in “static” condition as per log book there was

a continuous dip in stock levels as per the ATG readings even after considering the drained water level. Deviations were in the range of 9 KL to 102 KL for 10 tanks.

An Oil Refining Company operating two refineries in Abu Dhabi and producing over 23 million tons per year of products for the local and export markets. C

lient



Key Recommendations

Analysis for dip in ‘Static’ Product Tanks


• Align the terminology of barrier groups in line with company guidelines and identify the missing barrier groups. • Group HSECES as per the requirements of company guidelines. • Develop HSECES performance standards for all the groups identified.

CASE STUDIES Case Study VI – HSECES Identification & Grouping

21

Observation

Identification of HSE critical equipment is one of the top priorities for any refining and terminal operations company to ensure adequate process safety management. For the terminal site of the refinery, we noted following: • Difference in identified barrier groups through COMAH assessment and

company’s guidelines leading to non-identification of 2 critical barrier groups. • Differences in identified barrier sub-groups (28 to 44) leading to non-identification

of performance standards critical for preparation of inspection, testing & maintenance plans for 4 subgroups.


lient



Key Recommendations

HSECES Grouping Guidelines


• Reporting format for summary of cathodic protection system condition in quarterly CP monitoring report should be modified in order to plan and monitor the progress of corrective actions effectively.

• Criteria mentioned in procedure “Guidelines for Monitoring Cathodic Protection System” shall be reviewed and updated accordingly considering the realistic timelines for taking corrective actions or initiating the corrective actions on CP system fault (i.e. data shall be analyzed after each Cathodic Protection (CP) monitoring survey and corrective action shall be initiated as soon as possible but in any case within one month.)

• Inspection section should raise contract request for replacement of anodes. • Inspection section in co-ordination with maintenance department should plan and expedite the corrective action

for CP system of hydrocarbon storage tanks.

CASE STUDIES Case Study VII – Cathodic Protection (CP) Monitoring

22

Observation

As per the guidelines for Monitoring Cathodic Protection (CP) system, data shall be analyzed after each CP monitoring survey and corrective action taken as soon as possible but in any case within one month. Based on the review of CP monitoring system, we noted delays in taking corrective actions on faulty CP system under tank bottom for 9 tanks, 4 from the year 2010 and from 5 from the year 2012. Also, it was observed that the replacement of 300 magnesium anodes for sewer piping in hydrocracker plant is pending since year 2011.


lient



Key Recommendations


• Estimate daily variations in the Tail gas/ Recoverable H2 receipt data in the monthly reconciliation statement report at the end of the month. Reasons for significant variations should be highlighted in the statement or should be communicated to Operations department to initiate appropriate corrective actions.

• Define the tolerance factor in the quantification SoP to monitor the variation between the Tail gas quantities as per invoice supporting documents, in order to ensure the difference is within acceptable limits from what is being measured at client’s end.

• Control Department should ensure timely calibration (Preventive) of the flow meters used for quantification and verification. • Prepare the monthly reconciliation statements and verify Tail gas invoice from provider only after the receipt of both the invoices and

supporting data corresponding to the tail gas supplied for any particular month.

CASE STUDIES Case Study VIII – Verification of Quantity of Tail Gas Received

23

Observation

1. Monthly variance of 7.4% in quantity of recoverable Hydrogen in monthly reconciliation statement of client and the transfer statements issued by provider.

2. Daily variance ranging from 40% to -54% in quantity of recoverable Hydrogen. Daily variance was not analyzed in the monthly reconciliation statement to identify the corrective actions required.

3. The denominator of the formula used for calculating the tolerance factor is not consistent. Further the tolerance factor is not defined in any of the procedures we were provided with.

4. Total invoiced quantity used for calculating the tolerance factor by client does not match with the actual invoiced quantity as per the provider’s invoice (Difference of 17,391 NM3).

5. We could not ascertain the calibration records of the flow meter due to inadequate calibration job completion details in the MAXIMO against the work order WO5734694 which was scheduled to be completed in April 2016.


lient



Key Recommendations

© 2016 Protiviti Member Firm for the Middle East Region This proposal contains confidential and proprietary information relating to Protiviti Member Firm for the Middle East Region and Protiviti Inc. The contents of this proposal including the information, methodologies, approach and concepts contained herein are confidential and are intended solely for the use by persons within the addressee’s organization who are designated to evaluate or implement the proposal. The proposal should not be shared with any third party or used for any other purpose or in any inappropriate manner.

maximizing value from technical (operational) audits...

Documents