Simple Risk Management

1. Understanding and Handling Residual RisksSPE Annual Technical Conference, Denver 2011John Zhao, MSc.

2. Simple Risk Management The loop may continue for a long time, but when and where the Risk Management should STOP ?

3. Thorough Risk Identification ? “Actually, I'm not sure if a risk assessment would have caught this one”. Borrowed from CartoonStock Missed Risks ≠ Residual Risks Secondary Risks ≠ Residual Risks Residual risks are net risks left over after safeguards (risk response actions) have been implemented.

4. What is a Residual Risk? How about P1 to P10 And P90 to P99 ? P10 P90 Simulation through Risk Analysis With 80% confidence

5. Common Problems with Residual Deliberately Hidden & Covered Hard to detect so dangerous. Ambiguous Acceptable Level “Tolerable” risks not defined Ignored as Probabilities low Lacking Discrete Simulation Unwillingness of Risk Taking Psychological Barrier to risks

6. Residual Risk Handling Principles Zero risk in any activity is not achievable; therefore → The risk tolerance, after mitigating actions, has to be defined by management; → Management may decide not to reduce residual risk further but to accept it; → The additional benefit of reducing residual risk level may not outweigh its cost;

7. Process of Handling Residual Risks Closed Risk Response Action Planning Effectively Lower Re-Rank Residual risk P x C Monitor Action Effects Not Effective Residual RESIDUAL Risk Treatment Insurance; Reserve; @RISK Simulation Accepting Above Risk Tolerance Level Negative Positive TEAM Benefit vs. Costs

8. Classic Risk Movement Example Risk: Incomplete modules may be shipped for offshore installation, resulting in increased costs, due to lack of stringent onshore QC. Initial Ranking: P5 x C4 =20 Action: A dedicated QC inspector will reside in module Fab Yard for checking / signing off. Monitor: Effectively lowed risk. Residual Ranking: P2 x C4 = 8 Residual Level still not desirable. But it is accepted with $x Million risk contingency for offshore repairs. Workable Unacceptable I High Probability Acceptable ? R High Impacts

9. Decision-making Rules • In the pessimistic scenarios, observe following rules: • ERM policy shall define residual risk acceptance criteria; • Insurance and emergency preparedness must be always in place; • Endeavor to lower initial risks below tolerance level; • Use ALARP and FMEAmethods for quantitative comparison; • Include both Discrete and Continuous simulations in decisions; • Accept residual risks if action costs higher than benefits;

10. Residual Risk using Discrete Simulation

11. Quantifying Residual Risks • Quantifying Residual Risk Impacts • Extreme value analysis - Rayleigh distribution • Double Triangular Distribution • Discrete distribution for Portfolio management • Rare event Risk Analysis – Fault Trees / Psychological Judgements

12. Funding for Residual Risks Residual Risk Fund, (Leftover / Rare) Business Contingency (risk) Allowance (experience) Base Estimate (quantity) Project Team • Validity of Low Probability High Consequence Estimates • Residual risk funds built up at Aggregated Portfolio level; • Check and validate key assumptions / simulation model; • Use common business sense to overcome psychological fears;

13. Residual Risks - Summary Defining Residual Risks “Residual risks primarily are leftover risks that are still above tolerable levels even after effective risk responses actions have been implemented”. Handling Residual Risks “Using good business common sense and quantified contingency plan to overcome psychological fears of residual risk events. Managing Residual Risks “It is the amalgamation of art and science, psychological judgement and technical reasoning, qualification and quantification processes.

14. Thank you Understanding and Handling Residual Risk Presenters name: John Zhao Presenters title: Quality and Risk Manager E-mail address: jzha@statoil.com www.statoil.com