Capital Project Risk Management

Foundations to Mastery

1

The future growth of many organizations and industries - including infrastructure, energy, utilities, mining, and chemicals – depends upon the successful implementation of increasingly large capital expenditure programs. After a period of under-investment – exacerbated by the economic crisis which began in 2008—companies in these industries are undertaking significant projects. A leading energy company recently declared a record $32.7 billion capital expenditure budget for 2012, while another announced a $15 billion infrastructure development plan for North America alone.

The International Energy Agency estimates that $1 trillion per year in new investments will be required from now until 2030. The Organisation for Economic Co-operation and Development (OECD) estimates that, by 2030, combined annual infrastructure investment requirements will represent 2.5 percent of the world’s gross domestic product (GDP). When electricity generation and energy-related infrastructure investments in oil, gas and coal are included, the annual share of GDP rises to approximately 3.5 percent.1 Many of these initiatives will be driven by the need to replenish proven and probable (2P) reserves and find new sources of cash flow, as existing sources of production are now entering their twilight years. There is also a global shortage of refining capacity.

While capital projects have always involved large expenditures with often long payback periods, these structural dynamics are increasing project complexity. Companies are undertaking increasingly large and complex projects in new geographies, working with new partners (for instance, partnerships between international oil companies and national oil companies from emerging markets) and utilizing new technologies. All of these factors increase complexity and add risk to already difficult undertakings.

2

Capital projects are becoming more exposed to intricate and interrelated risks including:

RegulatoryChanging regulatory regimes pose numerous new risks and requirements, particularly in the oil and gas industry. For example, new environmental regulations for the Coal Seam Gas (CSG) industry put in place in various countries or changing tax and royalty regimes.

GeopoliticalVolatile political conditions in a number of geographies including the Middle East, North Africa, Nigeria, Venezuela and Russia create the potential for government interference, “resource nationalism”, civil unrest and related challenges.

TechnicalNew and at times untested technologies may not function as planned, especially in remote locations or under severe geological or climatic conditions (e.g., oil and gas exploration in arctic waters off Baffin Island and Greenland); and, for some kinds of projects such as nuclear power plants, the required skills may be in extremely short supply, since few such projects have been attempted in recent years. New technology can also create uncertainty around safety management.

Supplier and contractorThe availability, competence, financial health (e.g., solvency), safety performance and increasing costs of contractors pose multiple challenges; companies are experimenting with risk-sharing arrangements with contractors and exploring other options to reduce supply chain complexity.

GovernanceNew partners and new governance models such as non-operated joint ventures present consortium members with differing standards and approaches to risk.

FinancialCompanies have been subject to increased volatility in commodity costs and prices along with more traditional exposures; for instance, swings in foreign currency spreads, counterparty credit risks and increases in the cost of insurance and options available.

ReputationalThe “not in my backyard” or NIMBY syndrome can delay or prevent capital projects from getting started. At the same time, involvement of numerous stakeholders2 presents ongoing risks to project viability. This type of risk can also create asymmetries – for instance, a reputational issue in one geography can have global repercussions on company investments elsewhere (for example, through enhanced regulatory

or community scrutiny following an environmental or social incident). ‘Social license to operate’, the support of the people that live and work in the area of impact and influence of a project, is progressively becoming a necessary aspect of any capital investment.

These risks are real and the stakes are high. In the current economic environment, there is a strong need to ensure returns on capital employed for such projects are optimized. However, senior energy industry executives estimate that over 40 percent of oil and gas capital projects are delayed,3 with average estimated at 12 months.4 This results in the erosion of net present value while affecting portfolio performance and the effectiveness of capital.

Capital project risk management is at a minimum, a way to improve project performance to time, budget and schedule. When it is embedded throughout an organization, it can form the core of capital effectiveness and therefore be a source of competitive advantage.

3

Capital Project Risk Management and its Benefits

Capital project risk management simply refers to the identification, analysis, treatment and communication of uncertainties to the objectives of both individual capital projects and project portfolios.

Through effective capital risk project management, organizations can ensure that:

• Projectsarecompletedontimeandwithin budget;

•Costoverrunsanddelaysareminimized,improving the value of investment portfolios;

•Cashflowvolatilityisminimized;

• Decisionmakingcapabilityisincreasedthrough greater understanding of risk exposures;

• Earningsatriskareconstrained within a predictable profitability envelope, and

• Sharepricesaremaximized,asmarketsreward the company for consistent delivery on completion promises.

We have identified four key foundational principles that are necessary to effectively manage risks associated with capital projects. When these are in place, companies are in a position to ensure that capital project risk management is a core element of capital effectiveness and high performance.

4

The Four Foundations

Foundation One Run capital projects like a businessIt is important for those accountable and responsible for the delivery of capital projects to think and act like business owners, not just project managers. While large capital projects involve many moving parts, they all entrust project managers as stewards of the company’s capital.

The leadership team should consider measuring success in terms of time to operation and the financial importance of this to the business. This implies making sure each project is integrated with, and transparent to, the company’s business from the very beginning. In risk management terms, this means that risk tolerances and appetites for the project need to reflect those of the organizations involved.

Three important ways in which an organization can move from a project-only to a business mentality are:

Align Risk Management with Strategy and Project Delivery• Toooften,riskmanagementisviewed

as a menu item to be ticked off by project teams. This happens when risk management objectives do not reflect strategic project objectives. This leads to risk management proceeding on a compliance rather than a performance mindset and execution suffers. This can be overcome by ensuring that:

- A project’s risk profile is aligned to the company’s overall risk appetite and driven by the project strategy. The project profile should also be visible and transparent to the project team.

- Company risk appetite and tolerance are reflected in the criteria used in risk management – this will help clarify how risks are managed. In fact, examining risk criteria is often a good litmus test of whether or not risk and strategy are aligned. If companies can “see themselves” in the risk criteria and methodology used, this is often a signal that they accurately reflect the strategy. Conversely, if they appear “generic” or applicable to “any old project”, this is often an indication that they don’t and should therefore be reconsidered.

Get the Organization RightProject organization is a significant factor in performance. Risks are minimized when:

• Incentivesofteammembersdonotcreate excessive or unnecessary risk-taking (for instance, we have found that on poorly performing projects, those shaping the project at the early stages can have incentives to get through stage gates too quickly, thereby creating greater risks in later stages). A risk-focused review of incentives within a project team can reveal where and how performance targets can create wider, unintended project risks.

•Ariskcultureisinstilledacrosstheorganization. This means that risk-focused behaviors are emphasized, incorporated into performance objectives and measured. This assists in ensuring that risk management is not seen simply as the purview of risk managers and is embedded within the organization. This should include effective risk management training and communication.

•Governanceandreportingstructuresshould provide clear visibility of top risks to senior management and decision makers. Good risk analytics and reporting can assist, providing company leadership with sufficient line of sight into key risks.

Manage Suppliers EffectivelySuppliers capable of handling large, complex capital projects have undergone significant consolidation in recent years, and companies can no longer dictate terms on major projects. Finding and securing the contracting support needed to complete such projects has become a significant undertaking in and of itself. We find that companies that manage capital project risks effectively often develop relationships with key suppliers that extend from project to project, or that link multiple projects, giving suppliers the opportunity to spread their own risk and to allocate resources and expertise more efficiently.

The number and type of suppliers involved in any project can similarly be complex. Companies that manage capital projects well are able to ensure the risks that these numerous relationships create are assessed and managed. For example, some contractors may come into close contact with local communities during the construction phase of a project, effectively representing the operating company. If the risks these interactions can pose are not identified and managed, projects can become susceptible to community-led opposition, reputational damage or related problems. We find that companies that maintain visibility and ownership of the web of supplier relationships they possess, reduce project risk.

5

Foundation Two Align project partnersWhere projects involve multiple partners, risk appetites, tolerance and corresponding processes and approaches to be deployed throughout the project should be defined and agreed. This should involve all partners not only approving these, but subsequently embedding the risk management approach within the project’s operating model.

Get the Governance Right Upfront investment to achieve alignment on risk management is crucial. It will protect the project later on, as it makes decision-making more efficient and transparent. It is alarmingly easy for key risks and issues to slip through governance cracks and wind up with no owners. When this happens, the likelihood of risks occurring dramatically increases.

For projects run by a consortia of companies, a governance framework should be established on three levels:

1. An internal governance structure is essential for communication and decision-making. The internal structure helps the company maintain discipline, keeping the project on time and on budget.

2. A project-wide governance framework can help determine which levels of risk are acceptable to all partners, as well as how such risks are identified, reported and managed.

3. Companies should agree on principles to monitor and assess risks. The introduction of key risk indicators (KRIs) supports the necessary level of transparency and visibility. In addition it helps measure the effectiveness of management strategies in reducing risks exposures.

Put an Extra Focus on Non-Operated Joint Ventures (NOJVs)Non-operated joint ventures (NOJVs) are challenging for obvious reasons – companies do not have managerial control of the project. This, however, is not an excuse for the joint venture partners to ignore risks or leave the project to the operators alone. Companies should:

• Incorporateriskmonitoringon NOJV projects;

•Useinfluencingstrategieswhererisklevels appear to be deviating from the tolerances or expand beyond the approved risk envelope;

•Agreeondisputeresolutionmechanismsalongside the establishment of the NOJV so that when inevitable disagreements arise, they can be resolved quickly and effectively.

Foundation Three Manage “above-ground,” “non-technical” risks in capital projectsMany delays in capital projects are the result of regulatory (e.g., permitting complexity), stakeholder (e.g., loss of social license to operate, labor issues, environmental scrutiny), political (e.g., expropriation, political violence), and reputational (e.g., NIMBYism) risks. For example, “resource nationalism” stemming from government actions to raise taxes, royalties or carry out cash flow expropriation can significantly affect project economics. Such actions often occur after significant capital is sunk into projects. In many cases, these kinds of risks are beyond the core expertise of project leadership and consequently may not receive the treatment that they warrant.

To ensure that capital projects are managed effectively consider the following:

Measure non-technical risksNon-technical risks are often not managed because they are not measured. Some companies employ subject matter experts to explore risk areas that are outside the core competency of the company and project team (e.g., experts on a particular country’s politics or on local community dynamics). Companies similarly have methodologies to manage social and environmental performance. However, high performers go beyond this by measuring these risks using core commercial metrics. For instance they may use Bayesian analysis to incorporate these risks into project net present value (NPV) calculations. Similarly, some companies use organization network analysis to model the impact of different risk types. We find that when non-technical risks are measured in

the same way as more traditional risks, they are managed more effectively.

For instance, these types of analyses can reveal that it makes sense for a company to slow down the early phases of a project to conduct stakeholder consultation and partnering. This can create an approach that achieves buy-in from key stakeholders and avoids project delays from protests or court orders later.

Ensure Accountability and Decision-Making Authority around Non-Technical RisksWith effective measurement, it is easier to assign accountability for non-technical risks. It is crucial that those responsible for specific areas have a “seat at the table” of project decision-making. For example, a director of community relations on a project should have sufficient resources and authority within the project governance structure. This will help ensure that project delivery is not unnecessarily compromised by a lack of understanding of these types of risk.

Foundation Four Use strategic objectives to define quantitative approachesAll capital project teams should quantify and stress test their risk exposures using techniques such as Monte Carlo simulation and other financial risk management tools. These might include modeling techniques used in other areas of finance, such as derivatives trading. Some companies, for example, use Value at Risk (VaR) to assess the economic impact of commodity price risk on their projects. However, quantitative techniques should always be focused on delivering value to decision-makers and planners, not as an end in themselves. As a consequence, project strategy should define quantitative approaches, not the other way around.

To maximize the benefits of quantitative techniques, companies should bear two critical considerations in mind:

6

Ensure Modeling Approaches and Results are Understood by Decision-MakersQuantitative models are useless unless decision-makers can understand and use the results they produce. Critically, they need to understand both the advantages and limitations of the results that models produce. This can be accomplished when:

•Quantitativemodelsemployedfollow the strategic imperatives of the company (for instance, if the company has a focus on cash flow, then it should consider a cash flow-at-risk modeling approach rather than a model that tests predominantly earnings or capital metrics);

• Theassumptionsofquantitativemodels are clearly communicated and understood;

• Thehypothesesandincomingdataofmodels are defined and shared by every individual involved in the evaluation;

• Simulationresultsareunderstoodbydecision-makers.

Use Models to Stress test Risk ExposuresMany companies use databases of historic project costs and schedules to estimate the cost and duration of planned projects. However, relying on historical data alone can provide a false sense of security. Historical data is not available for many types of capital projects (particularly those in new geographies or employing new technology). Historical approaches can also underestimate volatility of prices, costs, or the probability of “extreme events”.

Conversely, stress testing allows management to understand the effect of an extreme event on the project, helping management identify flaws and gaps in the risk measurement methodology. When accurate data and appropriate computational tools are available, stress testing can be an effective technique for assessing the consequences and impact of risk events. By identifying risk factors (for example, extreme cost spikes or pricing events), creating and assessing scenarios, companies can see which actions may be necessary to reduce the exposure and manage the risk profile. In addition they can evaluate whether the mechanisms and resources are in place to take these actions.

Mastery Capital project risk management to drive capital effectivenessOnce an organization is able to apply the four foundational principles effectively and consistently across a number of projects, it will be in position to utilize risk management to contribute to greater capital effectiveness. Figure 1 provides a capital risk management maturity model.

Mastery of capital project risk management involves the following elements:

• Post-performanceappraisals–learningfrom mistakes: Developing a knowledge management system around project performance can help organizations achieve high performance. Too

often, mistakes get repeated while the knowledge of the individual who contributed to good performance remains bottled up within the company or worse, departs to a competitor.

•Aggregationofriskprofilesacrossportfolios: If companies are able to accurately assess project risks and aggregate these into portfolios to evaluate the risk profiles, it will help them understand where and how capital is underutilized and where additional opportunities may reside. This can include using a common set of risk typologies found across different project types.

•On-timedeliverymanagement:Once a company develops a level of confidence around its ability to measure and manage capital project risk, it will be in a better position to more accurately estimate and disclose project completion dates to investors – and then deliver on those promises. Doing so can create a share price premium and reduce the cost of capital.

•Asymmetrymanagement:Oneoftheleast understood aspects of capital projects is how reputational risk can defy the size of a project. For instance, an environmental issue in one project can have repercussions on how regulators view the company in other geographies. Aggregation of risk across portfolios should include the modeling of reputation risk and its linkage across projects.

Capital projects are an increasingly important yet challenging aspect of companies’ future growth and profitability. Those companies that master effective capital project risk management will create enduring and significant value for their shareholders.

Figure 1 – Capital Project Risk Management Maturity Framework

Fragmented performance

• Awareness of the importance of risk management

• Strong performance on somecapital projects but consistencyremains elusive

• Organizational challenges onmany projects, leading to delays

• Focus on performance managementremains overly technical, not commercial

Strong technical projectperformance

• Technical risk management on capitalprojects is well managed and linkedto financial performance

• Partnerships, particularly Non-OperatedJoint Ventures (NOJVs) remain challenging

• Quantitative models used inconsistenly

• Non-technical risks remain a factor in delay and cost overruns

High project performance

• Strong project-level riskmanagement leading to minimaldelays and overruns

• Non-technical risks wellintegrated into capital projectrisk management

• Inconsistent aggregation of lessons learned across portfolios

• Minimal linkage between projectperformance and capitaleffectiveness

Capital project risk management mastery• High performance across all

capital projects

• Lessons captured across projects

• Capital project risk managementa key component of capitaleffectiveness

• Company reputation for consistent on-time delivery isreflected in share price and cost of capital

Valu

e

Maturity

About the authorsAliette Leleux is an executive director – Risk Management, cross industry, corporate finance lead for France, treasury lead for Europe. Based in Paris, and with over 17 years of global consulting and industry experience in the risk and finance space, Aliette guides large conglomerates and forward-thinking organizations in the finance, resource, product and public sectors in transformation projects and assignments on their journey to high performance.

Ben Cattaneo is a manager, Accenture Risk Management and works within Accenture’s Cross-Industry and Resources team. Based in London, Ben possesses over 12 years of experience helping clients manage risks associated with complex capital projects, design and implement enterprise risk management (ERM) programs, and manage acute crises. Ben combines deep risk management expertise with strategy and change management skills to help clients become and remain high-performing businesses.

We would like to thank Phil Herschke and Craig Murray for their contribution to this publication.

DisclaimerThis document is intended for general informational purposes only and does not take into account the reader’s specific circumstances, and may not reflect the most current developments. Accenture disclaims, to the fullest extent permitted by applicable law, any and all liability for the accuracy and completeness of the information in this document and for any acts or omissions made based on such information. Accenture does not provide legal, regulatory, audit, or tax advice. Readers are responsible for obtaining such advice from their own legal counsel or other licensed professional.

About Accenture Risk ManagementAccenture Risk Management consulting services work with clients to create and implement integrated risk management capabilities designed to gain higher economic returns, improve shareholder value and increase stakeholder confidence.

About AccentureAccenture is a global management consulting, technology services and outsourcing company, with more than 246,000 people serving clients in more than 120 countries. Combining unparalleled experience, comprehensive capabilities across all industries and business functions, and extensive research on the world’s most successful companies, Accenture collaborates with clients to help them become high-performance businesses and governments. The company generated net revenues of US$25.5 billion for the fiscal year ended Aug. 31, 2011. Its home page is www.accenture.com.

References1 Organisation for Economic Co-operation and Development: http://www.oecd.org/dataoecd/24/1/39996026.pdf

2 Stakeholders can include the general public, local communities, governments, environmental groups, workers’ councils and labor unions

3 Booz Allen: Capital Project Execution in the Oil and Gas Industry

4 Goldman Sachs: 190 Projects to Change the World

SourcesCapital Projects in a High Risk World: A Best Practices Perspective, Accenture, February 2012

Charting a New Course in Capital Projects in Australian Mining and Energy, Accenture, October 2011

Booz Allen: Capital Project Execution in the Oil and Gas Industry, 2006

Goldman Sachs: 190 Projects to Change the World, 2008

Copyright © 2012 Accenture All rights reserved.

Accenture, its logo, and High Performance Delivered are trademarks of Accenture.

12-1878