Global Risk & Trading

CREATING VALUE UNDER PRESSURE:

WHY NATIONAL OIL COMPANIES NEED RISK MANAGEMENT IN A SHIFTING ENVIRONMENT

By Mark Robson

While it is not unusual for successful companies to be challenged to manage risk when making critical decisions regarding new investments, existing projects, and operations, for NOCs the stakes are even higher. Their actions can potentially change the futures of their countries. If NOCs wish to continue funding their governments visionary strategies in this new environment, they must develop sound risk governance practices.

National Oil Companies (NOCs) in the Middle East are under pressure. Volatile crude oil prices, massive infrastructure programs, and rising domestic demand for energy relative to GDP are changing their competitive landscape. And while it is not unusual for successful companies to be challenged to manage risk when making critical decisions regarding new investments, existing projects, and operations, for NOCs the stakes are even higher. Their actions can potentially change the futures of their countries. If NOCs wish to continue funding their governments visionary strategies in this new environment, they must develop sound risk governance practices. Most of the critical variables that NOCs consider in their strategic planning process have become more unpredictable. The pace and scale of events introducing uncertainty into earnings are increasing. Risks such as volatile commodity prices have become more important, and supply chains have become more complex. Add to this the recent instability of sovereign nations, Arab Spring events, and Iranian threats and it is easy to understand the importance of developing an astute recognition of risks as well as the opportunities that they may present. States are increasingly focused on understanding what drives the level and volatility of NOC earnings. Their concerns are justified. Such organizations can make critical strategic miscalculations if executives do not understand the net impact of the risks embedded in inputs, outputs, overall operations, and the markets in which they operate. State owners objectives can also be different from those of a NOCs management team. This can create problems in defining value and determining the organizations appetite for risk. ExhIBIT 1: ThE SEVEN STAGES OF RISK MANAGEMENT
INSURANCE AND COMPLIANCE CORE RISK MANAGEMENT
SPECIFIC RISK QUANTIFICATION We need to know the economic impact of our largest risks.

RISK-RETURN OPTIMIZATION 7 6
RISK AND GROWTH APPETITE DEFINED, RISK DYNAMICALLY MEASURED AND AGGREGATED PROPERLY Shareholders demand a risk/return framework. RISK-ADJUSTED RESOURCE ALLOCATION AT ALL LEVELS Decision-making across the rm is linked to building economic value.

Value Added for Company

OVER-RELIANCE ON CHECKLISTS, FALSE SENSE OF SECURITY Regulators are demanding risk management activities (i.e., SOX)

4 3
QUALITATIVE RISK MANAGEMENT We need a sustainable process for monitoring all our risks.

5
OVER-CONTROL BY CENTRALIZED RISK MANAGEMENT, INITIAL QUANTIFICATION MODELS TOO PRIMITIVE Risks need to be quantied comprehensively.

1
RISK TRANSFER VIA INSURANCE Risk management equals buying insurance.

Degree of Sophistication Typical development path

Source: Oliver Wyman

Enhanced development path

Copyright 2012 Oliver Wyman

Most organizations realize this. But far too often the underlying risk management process has no real connection to the organizations strategic or financial management. Instead, its a costly, resource-intensive, compliance-driven, bottom-up evaluation exercise that often results in lists containing hundreds of risks. The process is designed to be comprehensive rather than to focus on the few key risks and opportunities that can and should be managed. Compounding the problem, parallel or overlapping risk management programs are often scattered across organizations without any real coordination. Treasury, operations, engineering, procurement, legal all of these functions manage key risks to the organization, often in isolation and using completely different measurements. A companys financial planning and analysis (FP&A) group considers the variability in the financial forecast, while internal audit develops its own plans for risk. Strategic planning groups are left to create their own quantitative and qualitative assumptions of the risks over the medium and long term, if they are explicitly considered at all. The result? Inconsistent and insufficient risk approaches emanate from weak governance and controls. Many NOCs fail to recognize the impact of this in part because of the barriers to competition they benefit from. Nevertheless, all too often, financial planning and capital decisions remain disconnected from risk management. Multiple projects are pursued with little understanding of how risk flows through the portfolio of projects. At the same time, overly optimistic assumptions catch management teams by surprise and put strains on their organizations available cash flow. This has been particularly evident in many of the regions real-estate projects that have recently been placed on hold. There is a better approach. NOCs need to develop a clear risk appetite statement and use dynamic financial planning as a top-down, strategic examination to address the drivers and core material risks across their organization such as the price of oil, the availability of talent, and the rapidly expanding portfolios of projects. Consider: Saudi Aramco currently has $230 billion committed to two projects with Sinopec and Dow alone. And the United Arab Emirates and Saudi Arabia will have to train hundreds of nuclear technicians for up to seven years in order to operate the facilities planned in their nuclear programs. The potential rewards are substantial: A management team can optimize a companys returns because it will be able to quickly, easily, and accurately evaluate the impact on financial statements of different scenarios involving multiple risks. Such an approach recently helped a state-owned airline avert massive hedging losses. In a similar fashion, a major state-owned railroad company significantly boosted its return on capital after an evaluation of the organizations key risks revealed the need to renegotiate its power contracts. Implementing dynamic financial planning requires a multi-stage effort. Oliver Wyman usually recommends that a company start by using this process to address its most pertinent issue. Is the company at risk of running out of funding? Does a key strategic decision need

Copyright 2012 Oliver Wyman

to be made? Alternatively, a company may wish to focus first on applying dynamic financial planning to a large capital project or critical business unit. That way it can determine whether or not the risks involved are aligned with its overall appetite for risk. Maintaining a brisk pace on a first, short, and focused dynamic financial planning initiative is important because quick wins help build momentum. Early improvements make it easier for executives to extend the framework across the organization, eventually resulting in a more focused risk-return culture. In our experience, organizations must take four steps to successfully incorporate dynamic financial planning into key enterprise-wide decisions:

DEFINE A RISK APPETITE

A risk appetite statement is an agreement reached between the board of directors and senior management about which risks should be managed and which risks should be avoided. Metrics are defined for those risks that need to be managed to establish when a management team should escalate an issue to the board. In developing these metrics, a management team may not agree on which risks are acceptable and at what level. But the process of developing a risk appetite statement can provide clarity around such issues. It can also facilitate alignment among management team members as to what risks the organization should address at what level.

hOW A NOC DEFINED ITS RISK APPETITE

A NOCs management team wanted to develop a long-term strategy. But the executives could not agree on which asset classes and projects the organization should focus on. The list of potential initiatives was long. It included options from every stage of the oil value chain. The team was considering pursuing significant new ventures in everything from natural gas, to petro-chemicals, to renewables. In addition, they were contemplating whether the NOC should focus on domestic or international programs. International investments could entail further complications since the organization might need to carry them out with a partner. While executives generally agreed that most of these investments were on-strategy, they disagreed over how much of the NOCs entire investment portfolio to devote to each type of project. To reach a consensus, the board of directors developed a risk appetite statement that broke down the potential risks involved into four key components: Commodity price risk (measuring the risk in the revenue stream), technical risk (measuring the NOCs ability to work with new technologies), project execution risk (measuring the complexity and ability to run the construction project), and country/partner risk (measuring the risk of managing non-controlling, domestic relationships). By comparing each potential set of investments against this newly defined risk appetite in portfolio and scenario models, the board and management team were able to rule out a number of potential investment combinations. Ultimately, the NOC chose the most profitable strategy for the amount of risk that the organization wanted to assume.

Copyright 2012 Oliver Wyman

Organizations that align their risk appetite with their risk-bearing capacity can determine more easily if they are being too conservative in areas where they might be more aggressive. Or conversely, they can determine if they are being too aggressive in areas where they might be more conservative. By defining which risks are on-strategy and which are off-strategy, organizations can minimize activity on those that are less important (or move risks to another entity, as NOCs are sometimes able to).

PRIORITIZE CORE RISKS

To realize value from dynamic financial planning, executives must first agree on the most important risks to their entire organization. Typically, 10-15 risks account for roughly 80% of a companys total risk exposure. Yet organizations often waste a lot of time and effort developing risk maps and risk registers filled with risks that have limited meaningful impact. Ideally, organizations measure the impact of a few dozen key risks, at most, on a continuous basis under different market conditions. Executives must therefore agree on the metrics used to measure success for the entire company. They should identify which financial metrics are most important: Cash flow? Earnings per share? Net debt ratio? The risks that are most likely to cause the company to not meet these key metrics or, conversely, to perform well against them, are the risks that must be most actively measured. After reaching this consensus, executives can then develop a common understanding of the greatest operational, financial, and strategic risks to these metrics as well as the underlying issues that drive them. Indeed, its often more effective to assess and quantify the risk drivers because this yields a better understanding of how a risk could ultimately manifest itself. ExhIBIT 2: DYNAMIC FINANCIAL PLANNING FRAMEWORK DESIGN
Risk-adjusted Decisions Decision making body Pre-requisites Former integration 1. Risk Appetite and Governance 2. Large Project Management Capital Budgeting Strategic Planning Executive Management Risk Analytics Strategic Risk Risk categories Financial Risk Operational Risk
Source: Oliver Wyman

Performance Measurement

Mergers, Acquisitions & Divestitures

3.

Risk Resources

This same information should also inform longer-term strategic initiatives such as acquisitions, large projects, and capital investments. Such plans can be better assessed, prioritized, and monitored with consistent risk-return reviews.

Copyright 2012 Oliver Wyman

AGGREGATE RISKS
While prioritizing risks is important, it is still insufficient. Since the activity takes a simple view of the sources of risk, it often fails to identify those issues of greatest concern: The risks that move financial statement items, the circumstances that cause them, and how these risks inter-relate. Key risks must be aggregated and quantified to determine how they will likely impact financial projections. Only then can executives begin to analyze the volatility that risks may introduce into an NOCs financial statements, ranging from its short-term cash flow to its annual earnings to its long-term balance sheet. Linking risk management to mid-term financial planning also allows a company to attain more transparency and precision in its financial plans. ExhIBIT 3: DETERMINING ACCEPTABLE RISK TAKING ThREShOLDS
EARNINGS SHORTFALL IMPACT $0.03 $0.06 Miss analyst consensus EPS estimate (below $2.27/year) Miss EPS estimate (below lower bound of $2.24/year)

CONSIDERATIONS Shareholder and debt holder perspectives should be incorporated

$0.10-0.50

Credit rating (Moodys) downgrade (from Baa 3 to Ba 1)1

Companys ability and willingness to take energy related market risk Risk policy and expressed business unit limits (i.e. capped at $0.02/year) Scenarios that push the company beyond acceptable EPS thresholds External market driven Internal strategy driven

$0.94

Dividend cut (below target of $1.36/year) Default Expected EPS $2.30/year 2011

DEBT DIVIDENDS SUSTAINED STRATEGIC GROWTH PAYMENTS CAPEX (CURRENT) CAPEX (NEW)

CASH FLOW REDUCTION

Source: Oliver Wyman

Armed with this information, executives can more clearly understand the potential impact of various management actions such as making new investments, managing the spend rate on existing investments, or initiating mitigation actions. This enables management teams to refine their plans rather than be forced to fix a big problem once it has already occurred.

Copyright 2012 Oliver Wyman

LINK RISKS TO STRATEGIC DECISION MAKING

Finally, NOC executives must consider these risks in evaluating critical strategic decisions. Whether an organization is deciding whether it should expand into a new country, move into downstream refining and marketing, or diversify into renewables, its important to quantify the key risks involved in each initiative and determine how often they may, or may not, be aligned with the companys overall appetite for risk. Based on that information, it becomes very clear what needs to materialize for the strategy to work. The figure below shows how evolving from a risk-only perspective, to a dynamic financial planning perspective that takes into account both risks and returns, to a perspective that includes the utilization of risk appetite, can alter the perspective of what the best investment may be. ExhIBIT 4: EVOLVING PERSPECTIVE OF FOUR INVESTMENTS
RETURN ONLY PERSPECTIVE RETURN RISK AND RETURN PERSPECTIVE RETURN N E U P U P RISK, RETURN AND RISK APPETITE PERSPECTIVE RETURN N E

N New renery E
Renery expansion

U Renery upgrade
P
Add pet-chem train

RISK N is the best project. Is N still the best project? U looks to be far riskier that E for only a small increment of return. P, while producing low returns, seems the safest.

RISK AS A % OF RISK APPETITE It seems that projects N and U are the most consistent with the organization. N is just a better project that E and P isnt really on strategy and is inferior to U.

Source: Oliver Wyman

Much of the information and expertise required to weave together dynamic financial planning and strategic decision making is already available within NOCs organizations. All that is missing is the connective tissue between disparate groups. Such connections are essential for executives to be able to understand and to evaluate the risk-return position of current assets and new investment opportunities.

Copyright 2012 Oliver Wyman

Developing this risk-return culture isnt easy. Initially, organizations require a risk management process and organization that will continuously deliver a standard set of reports with the information necessary to support financial decisions. Sometimes this may involve harmonizing data so that assumptions, such as expected values for input or output prices, are consistent across the firm. Executives must also take ownership of defining their organizations risk appetite and engaging in dynamic financial planning. Regardless of organizational structure, the process must be directed by someone who can commit and allocate the necessary resources. This person must have a holistic view of the organization. Otherwise, an NOC will likely duplicate risk management efforts. ExhIBIT 5: DYNAMIC FINANCIAL PLANNING ROAD MAP
Dene risk appetite Develop and implement group risk model Link key planning processes Restructure risk management organization Transform towards risk-reward culture
PILOT

Rene risk appetite

GROUP

Develop large project risk model Develop business unit risk model

Source: Oliver Wyman

Many executives may believe that their organization has already invested more in risk management than is reasonable. To these skeptics, we suggest conducting a small diagnostic. Assign some of your best financial staff for a few months to identify the most meaningful 10-15 financial, operational, and strategic risks. Then aggregate these risks and quantify how they might impact your financial projections over a one-, two-, and five-year time horizon. This minimal, but worthwhile, investment will likely surpass the bottom-line impact of past risk management initiatives.

Copyright 2012 Oliver Wyman

Questions executives should ask to determine if they have the appropriate dynamic financial planning resources in place:
how can I ensure that I focus on the key risks that impact decision-making (instead of drowning in hundreds of pages of risk reports)? What is the risk-bearing capacity of my organization? how large of a deviation from my plan is acceptable before I need to significantly change course? What is my risk appetite? how should I spread my risk tolerance over various risks? What risks are on-strategy and what risks are off-strategy? What are the five critical risks to my business and how can I mitigate these risks? Do I understand how uncertainty in the market will affect my credit rating? Is my plan for capital expenditures realistic under different economic and industry scenarios? Or will it leave the company short of capital? how robust is my mid-term plan given the uncertainties in the market? Under what alternative views of the future will I be unable to execute my strategic plan? how much volatility do my top 5-10 risks introduce into earnings?

Copyright 2012 Oliver Wyman

10

DRAFT

About Oliver Wyman With offices in 50+ cities across 25 countries, Oliver Wyman is a leading global management consulting firm that combines deep industry knowledge with specialized expertise in strategy, operations, risk management, organizational transformation, and leadership development. The firms 3,000 professionals help clients optimize their businesses, improve their operations and risk profile, and accelerate their organizational performance to seize the most attractive opportunities. Oliver Wyman is part of Marsh & McLennan Companies [NYSE: MMC]. For more information, visit www.oliverwyman.com About the Global Risk & Trading Practice Oliver Wymans Global Risk & Trading Practice enables the worlds top industrial corporations and commodity trading organizations to gain competitive advantages by assisting them with managing risk across their businesses more effectively. By working with global leaders in a broad range of industries, our practice has developed unique capabilities that help industrial corporations and commodity trading organizations create value and maximize their performance by making risk-adjusted strategy, investment and capital allocation decisions. About the author MARK ROBSON Partner, Global Risk & Trading, Oliver Wyman +971.4.425.7085 MARK.ROBSON@OLIVERWYMAN.COM Mark Robson is a Dubai-based Partner in Oliver Wymans Global Risk and Trading practice. he has over 20 years experience consulting in a wide variety of industries spanning energy, chemicals, pharmaceuticals, technology, and manufacturing. Mark specializes in designing approaches that use an organizations internal knowledge of its own operations and the competitive market place to create decision and risk management frameworks. These decision making tools have been applied to many contexts such as climate change analysis, strategic planning, capital budgeting, large project value optimization, corporate portfolio design, and financial hedging.

www.oliverwyman.com

Copyright 2012 Oliver Wyman All rights reserved. This report may not be reproduced or redistributed, in whole or in part, without the written permission of OliverWyman and Oliver Wyman accepts no liability whatsoever for the actions of third parties in this respect. The information and opinions in this report were prepared by Oliver Wyman. This report is not a substitute for tailored professional advice on how a specific financial institution should execute its strategy. This report is not investment advice and should not be relied on for such advice or as a substitute for consultation with professional accountants, tax, legal or financial advisers. Oliver Wyman has made every effort to use reliable, up-to-date and comprehensive information and analysis, but all information is provided without warranty of any kind, express or implied. Oliver Wyman disclaims any responsibility to update the information or conclusions in this report. Oliver Wyman accepts no liability for any loss arising from any action taken or refrained from as a result of information contained in this report or any reports or sources of information referred to herein, or for any consequential, special or similar damages even if advised of the possibility of such damages. This report may not be sold without the written consent of Oliver Wyman.