DNV Consulting has carried out a survey among 17 top managers (CEOs, MDs and CFOs) of operators and licence holders in the North Sea regarding enterprise risk management. Here are some of the key findings, and Shell Norway’s Managing Director, Johan Nic. Vold’s thoughts on enterprise risk management in practice.

“Enterprise risk management provides the framework for achieving a balance between taking the right risks and minimising the remaining ones,” says director in DNV Consulting, Magne Tørhaug.

Higher oil and gas prices do not necessarily make it any easier for individual companies to succeed. Rather, the rules have changed, the stakes are higher and not winning the upside is the biggest risk.
“We see that all respondents are actively seeking risks in the traditionally strong risk management areas of the oil and gas industry, i.e. in exploration and field development; and we see some strong practices of managing finance and market risks,” says Magne Tørhaug, director in DNV Consulting.

“However, many participants in our study confirm that their focus is more on avoiding mistakes than on capturing opportunities. Risk management is usually perceived as a loss prevention mechanism or as part of a defensive strategy. Now that access to new acreage is the most important business driver, a more aggressive risk strategy is vital,” he says.

Don’t put all your eggs in one basket.
“Let me give an example,” he says. “A portfolio of risks makes it easier to strike the right balance in terms of assuming risks to capture opportunities. If you have just one field in one country, your risk may be too high. Several foreign or smaller operators tell us that they see this as a particular challenge in Norway – it has been difficult to build a robust portfolio of prospects which could enable a balanced risk exposure.” He concludes, “A good strategy makes clear the types of risks a company can assume to its own advantage, the magnitude of the risks it can bear, and the returns it demands for bearing them.”

Most companies have enterprise risk management in place.
The survey shows that:

• Nearly 90% of the companies have a risk management policy in place
• Most companies have defined risk categories and methods for addressing risk
• Close to 90% of the respondents strongly believe that it is acceptable to voice risks in their organisation and have used risk assessments to stop unacceptable activities
• Improving decisions and value creation is the prime reason for undertaking enterprise risk management implementation – not pure compliance.

Reality, however, kicks in. Getting a real overview of a vast and complex oil and gas company and the risks it faces is tough. Making it comprehensible, manageable and actionable is even tougher. Ensuring that the organisational set-up facilitates decision making at the right levels is crucial to manage the link between operational risks and strategic risks.

Some difficulties:
The survey shows some elements that are difficult:

• 1 in 4 companies have not established arenas and fora for treatment of risk pictures.
• 1 in 3 companies report that operational risks influencing strategic goals are not escalated adequately throughout the organisation.
• 70% of the companies have a risk register but only 65% present their risk picture to their Board of Directors and only 55% to other stakeholders.
• Half of the companies interviewed are not satisfied with their implementation of risk management and more than half of the respondents see obstacles to enterprise risk management implementation in their organisation.