Oil and gas sector lagging on ERM, cyber and business continuity: IRM survey

The oil and gas sector has work to do to improve its risk management maturity, particularly around cyber, business continuity and ERM, according to the 2019 edition of the Institute of Risk Management’s (IRM) energy survey and report. The survey found that the level of risk maturity across the oil and gas industry was “dispiriting”, with a score of just three out of five. A lack of resource, visibility and independence for risk managers were cited as key issues holding back the risk function. Respondents also said many risk departments were often understaffed and budgets stretched. Speaking during an IRM webinar, Domenic Antonucci, a risk and technical training adviser based in the UAE, said the “middling” risk maturity score was “disappointing” for a sector with the sophistication and resources of oil and gas. The survey, which polled 50 global oil and gas companies, also found that only 40% of respondents use specialist ERM software. The IRM said major energy could companies would be expected to use such tools. The panellists on the webinar were surprised that 60% of oil and gas companies did not use ERM software. Such systems can be used to capture and store information on risk, and provide effective risk reporting and dashboards for key staff. Some 40% of survey respondents did not have a risk maturity matrix to track the effectiveness of risk management over time, across departments and regions. While only 37% of organisations said risk culture was embedded throughout the organisation. The report, titled Fuelling the debate: Latest Risk Management Trends in Energy 2019, also reveals a surprisingly low level of business continuity management (BCM) at oil and gas firms. Just 40% of companies surveyed have BCM plans in place. A further 20% intend to put such plans in place. Respondents overwhelmingly identified oil price as the biggest risk to their organisation during the next two to five years. Some 80% saw it as a major risk. Surprisingly, cyber was only considered a major risk by 10% of respondents, while only 17% perceived a major accident as a concern. Like the IRM report, the PwC Client Survey 2017 also found that oil and gas companies are lagging both ERM and cyber risk maturity, according to Mr Antonucci. “I was disappointed and surprised by the maturity rating and staggered to see an average rating for ERM and low levels of BCM. I was also staggered by the low importance given to the risk of a cyberattack,” he said. “Risk function budgets and training are also modest,” Mr Antonucci continued. “I am worried that the sector will rest on its laurels. Given the history and resource in the oil industry, I would have expected more investment in ERM, BCM and cyber,” he added. On a positive note, Mr Antonucci said there is now plenty of research into the economic benefits of promoting risk maturity, which risk managers should promote. “There is much room for improvement that the oil and gas sector can embrace,” he said. Alex Larsen, president of Baldwin Global Risk Services and host of the webinar, agreed with Mr Antonucci, noting that the low uptake of BCM was a key takeaway from the survey. “It is clear we do the core business well. It’s a risky industry. But from an ERM perspective, there is work to do,” he said. Mr Larsen also questioned why cyber and major incidents did not rank higher in the top risks facing oil and gas companies. The risk of major accidents is ever present, while cyber is unlikely to fall away in the coming years, he said. There has been a number of destructive cyberattacks against energy companies in the Middle East, including the so-called Shamoon malware, which hit Italian oil service firm Saipem in December 2018. Mark Boult, director of DNV GI, also highlighted cyber risks in the oil and gas sector. In particular, he noted the growing trend of remote operations, where an oil well, for example, is controlled from a distance, increasing reliance on IT systems and industrial control systems. “This has the potential for cyberattacks that could stop operations or cause major incidents. And if you use more software, there is the need to manage upgrades etc, which can result in glitches and problems. You need to be aware that this is a risk issue that will need to be managed going forward, as well as cyberattacks,” he said. According to Grant Griffith of the IRM in Turkey, the acceptance of risk management standards in the energy sector is, however, encouraging. The institute’s survey found that 80% of respondents used the ISO 31000 risk management standard, while just over 30% followed COSO 2004. “The 80% acceptance of ISO 31000 is a step in the right direction and shows it is the de facto standard. Organisations can comfortably adopt ISO 31000 and go from there,” he said. The survey found efficiency and cost-cutting remain key areas of focus for oil companies. While companies have been cutting costs to cope with a lower price of oil in recent years, the survey revealed that, confident of achieving profits, they now plan to invest in new projects.

Oil and gas sector lagging on ERM, cyber and business continuity: IRM survey

Want to read this article?

Read Next

Ferma members told AI will bring risk and reward for corporate insurance buyers

Aon’s revenues up 5% as it completes $13bn NFP deal

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

Pen extends fleet capacity deal with Zurich in Republic of Ireland

Ferma members told AI will bring risk and reward for corporate insurance buyers

Aon’s revenues up 5% as it completes $13bn NFP deal

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

Pen extends fleet capacity deal with Zurich in Republic of Ireland

Want to read this article?

Read Next

Ferma members told AI will bring risk and reward for corporate insurance buyers

Aon’s revenues up 5% as it completes $13bn NFP deal

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

Pen extends fleet capacity deal with Zurich in Republic of Ireland

Related Articles