Risk Governance: An Implementation Guide for Water Utilities WaterRF 4363

Transcription

1 Webcast June 25, 2013 Risk Governance: An Implementation Guide for Water Utilities WaterRF 4363 Simon Pollard Head, Environmental Science & Technology Cranfield Water Science Institute Cranfield University, U.K Water Research Foundation. ALL RIGHTS RESERVED.

2 Risk Governance: An Implementation Guide for Water Utilities Water Research Foundation #TC4363 Webcast, 25 th June, 2013 Prof. Simon Pollard Head, Environmental Science & Technology Cranfield Water Science Institute

3 This webcast Reporting on Project #4363 A primer for new risk managers in the water utility sector Led by Cranfield University, UK Sponsored by City of Calgary Water Services Supported by Halifax Water, United Utilities, Yorkshire Water, Southern Water, Water Corporation and UKWIR Co-authored with colleagues from University of Alberta, Yorkshire Water and Enterprise Risk & Resilience Ltd

4 Motivations for this research Increased prominence of risk management within utilities, including at executive and Board levels (vulnerability assessments, infrastructure interdependencies, water safety plans, climate adaptation plans etc.). Regulatory expectations of better risk management to demonstrate compliance, prevention with organisational structures (and people frameworks) in support. On-going catalogue of incidents suggesting human and organizational factors that contribute to outbreaks remain poorly understood. Utilities need for support on risk, beyond the provision of tools, to assist utility managers implement a risk management culture and secure executive support in progressing a utility-wide agenda.

5 Structure 1. Introduction 2. Recommendations for utility managers 3. The challenge of risk governance 4. Your organizational culture 5. Gaining support 6. Risk frameworks and tools 7. Setting a course 8. References Open questions via the Talkpoint platform

6 1. Introduction Why risk governance? Technical problems Assessment tools for hardware and the impact of failure Design Technical hardware Failures: Reliability Engineering Assessment tools for safety management systems Ergonomics People failures: Hierarchical Task Analysis. Human reliability Assessments People problems Human error: types slips lapses mistakes violations Human error: causes skill rule knowledge Accident The underlying basis of human actions/beliefs psychological sociological cultural political economic Failures of safety management systems Safety cultures issues. Attitudes to safety Assessment tools for safety cultures and attitudes to safety Socio-technical systems failures Management and organisational factors: management control System problems Management theory (after Hurst, 1998)

7 Why the Board level focus in this project? A narrow focus on monetisable loss and business interruption is no longer sufficient Visualisation and communications challenge exist around presenting risks and making them real, live and tangible Little open discussion of risk appetite, other than on insurance strategies Often unclear what they want to see themselves in terms of risk reporting, hence intermittent review rather than active vigilance Few risk champions on Boards risk governance often viewed as a regulatory/audit exercise rather than source of competitive advantage

8 The Just culture movement balancing accountability, organisational learning and acceptable behaviour Aviation and patient safety reporting; see Sidney Dekker and James Reason on balancing safety and behaviour. Signals pay attention to them, investigate them, don t normalise them Situational awareness, cognition, task performance and team behaviours Genesis of industrial accidents; see Andrew Hopkins on mindful leadership Cognition and human factors in the workplace; see Rhona Flin on situational awareness

9 What we know Sound risk governance generates value, confidence in others, no regrets decisions and a trusted partner status Managing risk, resilience, adaptation and opportunity is an journey requiring a responsive culture and agreed accountability Systems are complex flaws lie deep within them. Zero risk is not achievable; vigilance and progressive improvement is. Boards find risk data dry, static and at distance from the cut and thrust of operations. They must articulate risk appetite if employees are to be empowered at the sharp end. Opportunity and resilience discussions tend to be more engaging. Manage risk information intelligently is critical to learn lessons and act on them, improving system resilience, adaptability and accountability.

10 2. Recommendations for utility managers 1. Create a focal point for risk management 2. Engage with your management board 3. Aim to create value 4. Establish multiple barriers to prevent failure 5. Ensure barriers are cost effective 6. Be open to challenge and provide incentives 7. Be alert to home grown risks 8. Know that it can be done, but you ll need stamina to keep going 9. Make risk part of the organizational DNA 10. Remember that everyone is a risk manager

11 3. The challenge of risk governance Risk Zero management Operational incident Progressively deteriorating facility Episodic risks with management change Post-operational risks Residual risk Effective risk management Operational Post-operational

12 Asset management a paradox of putting assets at risk to protect public health Inspect (t i ) Inspect Inspection interval (t i ) depends on: Current condition condition assessment Rate of deterioration time to failure Condition threshold - criticality Good Condition threshold varies depends on criticality Poor Remaining useful life (t U ) Assessment of residual life (t r ) Time

13 Also - latent conditions and active flaws exist deep within all real systems Multi-barrier approach and Swiss cheese model of organisational incidents see mindful and high reliability organisations (after, Reason 2000)

14

15 4. Your organizational culture

16 Risk governance models

17 Know your risks and set your risk appetite (after, Strutt, 1998)

18 Use risk knowledge for organisational learning and defensible decisions Experiments and analyses simulations/ analyses experiments tests & observations monitoring operations benchmarking Data Information Evidence completeness, number of lines, direction, complementarity, individual strength and overall weight (Σ) of evidence Critique/review synthesis, reflection, peer review, analysis Σ Evidence defensible decisions Lessons learnt knowledge base Knowledge Decision making (after Strutt, 1998) Organisational learning

19 5. Gaining support a new risk manager s journey Risk specialization Enterprise risk awareness Good risk governance creates sustained value for organisations Risk management integration Risk/mitigation optimization (after Fraser, 2005) Senior Management and Board information needs evaluated; Preliminary risk profile developed; Policies established or refined; Standard terminology, techniques, documents established; Functional unit accountabilities clarified Risk profile refined (focus is on residual risks and tolerances); Regular reporting to Senior Management and Board of Directors established; Corporate risk assessment embedded in business planning; Local risk owners identified; local risk management expertise identified; skills and knowledge transfer occurring Corporate performance measures refined to recognize risk tolerances and priorities Risk assessment and prioritization fully embedded in business planning; Risk profile interdependencies recognized; Local risk management processes fully active 6 months 12 months months months Sophistication of process and implementation Clear ties between stakeholder value and risk management activities Comprehensive risk portfolio created; new risk exposures identified early; appropriate priority and mitigation determined quickly; Risk management embedded all key business processes, including strategic planning; Local risk management processes fully aligned with Corporate objectives

20 Blind spots for Boards

21 6. Risk frameworks and tools Risk appetite Government Probability of loss Carried by organisation Typical limits of insurance premium Carried by society (after Hartford, 2007) 10 6 Consequences (loss) 10 9

22 7. Setting a course know your system and its defences

23 Summary Prompts for utility managers 1. Understand and communicate the organizational risk appetite 2. Find pockets of good practice 3. Use risk knowledge to drive organizational learning 4. Find and eliminate or minimize latent flaws 5. Check if hard and soft cultural elements are in place 6. Consider benchmarking against others and best in class 7. Raise the bar on accountability for everyone 8. Expect good things from people

24 8. References On water quality incidents Hrudey, S.E. and Hrudey, E.J. (2004) Safe Drinking Water, IWA Publishing, 486pp. On risk tools and techniques Pollard, S. et al. (2007) Risk analysis strategies for credible and defensible utility decisions, Awwa Research Foundation research report 91168, Denver, CO, 88pp. On risk management culture in water utilities Pollard, S.J.T. et al. (2009) Developing a risk management culture mindfulness in the international water utility sector (TC3184), Water Research Foundation, Denver, CO, 117 pp. For executives and boards Airmic (2011) Roads to ruin. A study of major risk events, their origins, impacts and implications at: For researchers MacGillivray, B.H. et al. (2006) Risk analysis strategies in the water utility sector: an inventory of applications for better and more credible decision making, Crit. Rev. Environ. Sci. Technol. 36: For regulators Risk and Regulation Advisory Council (2009) Response with responsibility, London, UK, 43pp.

25 Thank you! Questions The Webcast concludes with the Q&A. Questions are typed and submitted via the TalkPoint platform