Corporate Risk Management Group

At first, the attempts to implement ERM were led by external consultants, but no lasting benefits or transfer of knowledge appeared to result from those initiatives. Then, in late 1999, the head of internal audit, John Fraser (one of the authors of this article), was asked to take on the additional role of chief risk officer (CRO). The Corporate Risk Management Group was established consisting of the CRO (part-time) and two full-time professionals, one with a degree in industrial engineering and one with an MBA in process reengineering and organizational effectiveness. The group was given six months to prove its worth. If it failed to demonstrate its value during this period, the idea of implementing ERM would be abandoned and the Corporate Risk Management Group dissolved.

In early 2000, the Corporate Risk Management Group prepared two documents with the help of experienced consultants: (1) an ERM policy (Box 28.1) and (2) an ERM framework (Exhibit 28.1). The ERM policy set forth the governing principles and who was responsible for specific aspects of risk management activities, and the ERM framework set out the procedures for ERM in greater detail. The Corporate Risk Management Group took the ERM policy and ERM framework to the Executive Risk Committee for discussion and approval. The committee, which consisted of the CEO and the most senior executives, suggested that a pilot study be undertaken with one of the small subsidiaries before formal approval of the policy and framework was sought from the audit and finance committee of the board.

Pilot Study

With some consulting assistance, the Corporate Risk Management Group planned the first ERM workshop in the subsidiary. Using its own staff, the group executed the first ERM workshop in spring 2000.

The workshop followed a conventional format. Prior to the workshop, a list of some 80 potential risks or threats to the business was developed and e-mailed to the management team of the subsidiary. Each member of the team was asked to choose the 10 most critical risks facing the company—and based on these choices, a list of the top eight was prepared. Then, at the workshop, these eight risks were discussed one at a time and their relative importance voted upon by the management team. Voting was accomplished using the Delphi method,¹¹ which involves a combination of facilitated discussions and iterative anonymous voting technology designed to quickly identify and prioritize risks based on magnitude and probability and to evaluate the quality of controls.

The first vote on the perceived magnitude of a particular risk—with risk defined on a five-point scale: Minor, Moderate, Major, Severe, and Worst Case—often showed wide dispersion. In each case, the initial vote was followed by discussion of the definition of the particular risk, and of its causes and consequences. Depending on the dispersion of votes in the first voting session, the discussion could be long or short. A second vote was then taken; and until a clear alignment or a clearly defined cause of disagreement was established, this sequence of discussion and voting might be repeated (usually no more than three votes were needed in practice). Then, with the voting and prioritization of risks completed, preliminary action plans were discussed and managers identified as “Champions” with the responsibility of developing more concrete action plans.

The discussions proved to be valuable. Issues that managers had thought about but never openly discussed were addressed. Concerns about some risks were allayed and new risks were identified; but in any case there was the beginning of a common understanding of risks and of a corporate plan for prioritizing action and resources to manage such risks. Since this was a pilot study for the Corporate Risk Management Group, the participants were asked to evaluate the quality and benefits of each workshop. The programs received high ratings and the managers of the subsidiary requested a follow-up session to discuss and rank the next eight risks that had been identified.

Final Approval

Following the pilot study in the subsidiary, the Corporate Risk Management Group returned to the Executive Risk Committee for debriefing. The pilot study was considered a success, and the chief risk officer presented the ERM policy and the ERM framework to the audit and finance committee of the board for approval. In the summer of 2000, the audit and finance committee approved the documents, and a roadmap for implementing ERM at Hydro One was established.

The Business Context

The ERM Policy of Hydro One in Box 28.1 defines risk as follows:

The potential that an event, action, or inaction will threaten Hydro One’s ability to achieve its business objectives. Risk is described in terms of its likelihood of occurrence and potential impact or magnitude. Broad categories of risk in Hydro One include strategic, regulatory, financial, and operational risks.

Since risk is defined by its potential to threaten the achievement of business objectives, it is imperative to clearly state these objectives and how they contribute to Hydro One’s overall strategy. The Corporate Risk Management Group found that objectives were not always clearly articulated, and that the workshop process from the pilot study helped in achieving clarity of business objectives needed to achieve the corporate mission.

The same was true of risk tolerances. Risk tolerances are guidelines that establish levels of acceptable and unacceptable exposures to any given risk (Exhibit 28.2 shows risk tolerances for 3 categories of risk out of 16). Tolerances define the range of possible impacts (on a five-point scale from Minor to Worst Case) of specific risks on business objectives. Through the workshops, a common understanding was developed as to how to categorize impacts from a particular risk on the firm’s ability to accomplish key business objectives.¹²

As an example, Hydro One has a financial objective related to earnings stability—namely, to limit the risk of a major shortfall in net income and the associated possibility of financial distress costs. One source of the risk to net income is loss of competitiveness; another is the volatility of financial markets.

A second important corporate objective of Hydro One is maintaining its reputation and public profile. One potential source of reputational risk is pollution damage; another is inappropriate employment contracts. In this case, the magnitude of the risk is not measured in dollar terms, but in terms of the extent of public criticism both on a local as well as an international basis.

Although the ERM policy of Hydro One states that “risk management is everyone’s responsibility, from the Board of Directors to individual employees,” the risk facing a specific project or line of business will typically fall under the accountability of a primary risk “owner,” typically the project manager or the business’s CEO.

Identification and Assessment of Risks and Controls

The approach to risk identification depends on the depth and breadth of the activities under review and the extent to which these activities are “new” to Hydro One. As described above, however, the process typically involves the identification of 50 to 70 business risks, which are then narrowed down to the 10 most significant risks through interviews and focus groups. In assessing risks, the aim is to understand both the size of the potential losses as well as the associated probability of occurrence. In theory, the correct way to portray the estimated effect of a risk is to use a probability curve that reflects the potential outcomes and associated probabilities. But given the practical difficulties of “building” such a curve, Hydro One has instead chosen to focus on the “worst credible” outcome within a given time frame and its associated probability of occurrence. This has proven to be a practical and efficient way to focus on major risks while avoiding excessive detail and complex calculations.

For all risks deemed to be “major,” Hydro One defines the “worst credible” outcome as the greatest loss that can result in the event that certain key controls fail. (As so defined, worst credible outcomes differ both from “inherent magnitudes,” which assume that all controls fail or are absent, and “residual magnitudes,” which assume that all key controls are in place and functioning.) The probability of such outcomes is evaluated for a specific time frame, generally two to five years, though for special projects the period is as short as six or nine months. As shown in Exhibit 28.3, Hydro One uses a probability rating scale from “Remote” (a 5 percent probability that the event will occur in the stipulated time frame) to “Virtually Certain” (95 percent probability).

After the Corporate Risk Management Group has helped management estimate the “worst credible” outcome, the impact on various objectives, and the associated probabilities for each risk (by workshops and the Delphi method), the next step is to produce a “risk map” like the one presented in Exhibit 28.4. The bubbles in the figure represent the expected effect of the risk on a certain objective in terms of its estimated impact (reflected on the horizontal axis) and the estimated probability that the impact materializes (on the vertical axis). In the case of each risk, the estimated probabilities represent the relevant experts’ best guess that the “worst credible” outcome will materialize. Management also uses the risk map to track the historical development of particular risks and to project expected future developments.¹³

The size of the bubbles in the figure indicates the extent of management’s confidence in the effectiveness of the company’s controls and efforts to limit individual exposures. Control assessment involves the strength of existing organizations, processes, systems, and feedback loops that are in place to manage the risk. The company has developed a “control strength” model that is designed to complement its risk tolerances. For any given magnitude of risk (from Minor to Worst Case), there is a corresponding strength of control, with “1” representing few controls and “5” representing full prescriptive controls with executive oversight.

Tolerability of Risk—and Risk Mitigation

Once risks and controls are assessed, a rank-ordered list of “residual risks” is assembled. The risk owner (for example, the subsidiary CEO or the project manager) then determines the firm’s tolerance for each risk. Within the limits of the risk owner’s accountability, the risk owner decides either to accept the risk as is or to take (further) steps to mitigate it. If the risk owner accepts the risk as is, the risk is monitored and reviewed in the normal future course of risk management processes. If the risk owner decides to mitigate the risk, the process of risk mitigation is defined.

Risk owners thus have seven possible ways of dealing with significant risks:

1. Retain: Risk exposure is accepted as is without further mitigation, since the potential return is viewed as desirable and the downside exposure is not significant.
2. Retain, but change mitigation: A partially mitigated exposure is maintained, but a change in mitigation reduces the cost of control.
3. Increase: Risk exposure is increased, either because the potential return is viewed as desirable or the controls in place are not cost-effective.
4. Avoid: Risk exposure will be eliminated entirely (perhaps by withdrawal from a business area or ceasing the activity), since the potential return does not offset the downside exposure.
5. Reduce the likelihood: Risk exposure will be reduced cost-effectively through new or enhanced preventive controls.
6. Reduce the consequences: The impact of any risk that materializes will be reduced through emergency preparedness or crisis response.
7. Transfer: Risk exposure will be transferred to others (perhaps through an insurance policy or an outsourcing arrangement).

As can be seen from the list, risk mitigation is not necessarily the same as risk elimination or risk reduction. As previously mentioned, the purpose of strategic risk management at Hydro One is to balance business risks and business returns by taking into account the potential upside as well as the downside associated with a particular risk. Thus, a balancing act may involve an increase in risk. In practical terms, however, an increase in risk at Hydro One is most likely to be decided at the strategic level. Once the strategic plan is set, the primary focus is on limiting the downside risk of failure to achieve stated business objectives.

Monitor and Review

Risks do not remain static. The magnitude and probability of a certain risk is affected by internal controls (mitigation) as well as external changes in the environment. Monitoring and reporting are fundamental to effective management of business risks. Furthermore, risks may not always be categorized correctly in the first place. Risks are notoriously hard to predict, and assessing risks is to a large extent a matter of qualitative guesswork. As physicist Niels Bohr observed, “Prediction is very difficult, especially about the future.”

An example of changing risk tolerances is Hydro One’s decision to issue shares on the New York Stock Exchange. During the period leading up to the scheduled offering, one of management’s greatest fears was the possibility of an unfavorable news story in the international press. As things turned out, however, the IPO was shelved. Then, in October 2003, the company had an oil spill that overflowed into a small stream and received a lot of press in Ontario.¹⁴ When this got the attention of both the Ontario Government (Hydro One’s shareholder) and the company’s board of directors, the Corporate Risk Management Group quickly realized that their greatest reputational exposure was not to the international press, but to the local press and its power to inflame the sensitivities of Hydro One’s primary stakeholders. As a consequence, negative provincial press stories are now identified as a worst-case scenario—considerably worse than their international counterparts—and strong measures are taken to avoid them.

Description of Risk Sources

The June 2000 Corporate Risk Profile in Exhibit 28.5 shows the list of the top risks ranked as “Very High,” “High,” and “Medium.” As of June 2000, 11 key risks had been identified. The figure also shows how these risks were rated in the previous profile and the estimated trend. And as the changes and trends suggest, the Corporate Risk Profile is by no means a static document. New risks arise with legislation or new initiatives. The severity of some risks can be reduced by mitigation efforts or changes in external factors. And the estimated severity of some risks can also change because the risks (and the consequences of mitigation) are better understood.

In addition to the major sources of risk and their trends, the Corporate Risk Profile also describes the corporate objectives that are likely to be most affected by such risks and the corporate controls being used to mitigate such risks. Below we describe each of the 11 major risks as evaluated in June 2000 and the corporate measures to manage such risks.

1. Growth: Hydro One has plans for significant growth through acquisitions of both existing and related businesses within and beyond Ontario. This is a major risk source because there are many substantial barriers to the achievement of the planned growth. Business development and financial results are the objectives most likely to be affected. The actions of the government (as owner) create the largest part of this risk because the degree of owner support for the acquisition strategy is not always clear and firm. Hydro One has limited experience in identifying, negotiating, and integrating significant acquisitions. The exposure to government actions is mitigated by senior management participation in government review processes and a proactive government relations function. Acquisition risks are mitigated by various means, including careful planning and analysis, staff skill development, and external advisors.
2. Regulatory uncertainty: The objectives of Hydro One are greatly influenced by the actions of regulators. The rules under which regulators operate will likely change as experience in the restructured industry is gained. Also, other stakeholder groups will influence regulatory decisions. The objectives most likely affected are financial results, legal/regulatory status, and reputation. Methods for mitigating this risk include increased and more effective interactions with the government and the Ontario Energy Board, increased priority and profile for regulatory matters within the company, and restoration of the company’s regulatory staff capability through the addition of senior regulatory staff.
3. Organizational readiness: Organizational readiness reflects the ability of the company to provide effective services to customers and to improve operating efficiency in the new business environment. Many systems and processes are recognized to be less than optimally efficient and some inefficiencies are amenable to IT solutions. Readiness has been both helped and made more complex by the departure of 1,400 of the most seasoned employees through the recent voluntary retirement program (see Box 28.2). This risk source impacts competitiveness and customer service. Methods being used to mitigate this risk source include performance contracting, compensation programs, labor relations strategies, and improved technology prioritization processes.
4. Network services launch: The risks associated with the creation of a separate subsidiary to provide wire network services in the open market are many and varied, including uncertainty about the form of the future competitive market, the ability of the business to achieve a competitive cost structure, and the regulatory treatment of the business’s reorganization costs. Possible consequences of such risks are reductions in competitiveness, reliability of customer service, and financial results. Mitigating this risk source involves a carefully crafted strategy and transition plan.
5. Asset conditions: The aging of asset wires and the possibility of underfunded maintenance and incomplete information about the condition of assets represent risks to customer service and reputation. Ways to mitigate this risk include redundancy on the transmission system, emergency response capability, and increased attention to this issue through higher planning priority.
6. Catastrophic events: Hydro One has assets covering a large geographical area, and the firm thus faces some exposure to destructive natural events such as tornadoes, which damage facilities every year, and ice storms, which are less frequent but can cause widespread damage and disruption of service. These events affect customer service, reputation, and financial results. Methods used to mitigate this risk include those listed under asset conditions (see above), as well as emergency preparedness plans and rehearsals, weather forecasting, and insurance.
7. Environmental contamination: This risk is largely driven by lands owned by the company that are contaminated with arsenic trioxide. Other contaminants are penta poles, transformer oils, and PCBs. To mitigate such risks to the firm’s reputation and financial results, as well as to the environment itself, the firm uses a combination of limited insurance coverage with initiatives designed to prevent such contamination.
8. Hazardous operating environment: Essentially all Hydro One facilities are electrically energized and so represent a threat to employees, contractors, and the public. In order to protect the firm’s reputation as well as ensure employee and public safety, risk mitigation is accomplished through facilities design, asset maintenance, safe work practices, and employee training and supervision.
9. Market Ready Project: The Market Ready Project is a major complex undertaking with uncertain requirements and has the potential to cause Hydro One to delay the province’s market opening, to cause significant customer or regulator dissatisfaction, or to well exceed its projected budget. Mitigation is provided by giving the project a high priority and profile. The recently announced delay in market opening reduces this risk, although it does not eliminate it, as even the delayed schedule is seen as tight.
10. New electricity market: The evolving electricity market exposes Hydro One to a wide range of unpredictable actions by competitors, customers, generators, and regulators. Any one of these parties may be able to erode the company’s market position or increase its costs, thereby harming financial results. To limit this risk, the company’s management is active on the IMO Board (the Independent electricity Market Operator) and is negotiating a comprehensive operating agreement with the IMO.
11. Economy/financial markets: Changes in commodity prices, exchange rates, or interest rates can have adverse effects on net income and cash flows. Hydro One has no commodity risk and does not trade in energy derivatives. The direct effect of fluctuations in exchange rates is considered insignificant, although this may change in the future if the company issues foreign currency debt. (All debt is currently denominated in local currency.) The company is, however, exposed to fluctuations in interest rates through its floating-rate debt (though corporate policy specifies that at most 15 percent of total debt can have floating rates) and through the refinancing of its maturing longer-term debt. Besides limiting its use of floating-rate debt, the company also periodically uses interest rate swap agreements to manage interest rate risk. Management estimates that a 100-basis-point increase in interest rates would reduce net income by roughly CAD 25 million—a risk deemed to be “Minor” or “Moderate” on the risk tolerance scale. All prudent expenses, including interest, are part of the rate base and recoverable through billing rates, so that any interest rate increase would eventually be recovered, but it would not be regarded as good management by the board and would show up as a reduction of profits in the current year.

Hydro One has some exposure to credit risk, both from its customers and from the possibility of counterparty default on its interest rate swaps. The credit risk associated with customers is effectively managed through a broadly diversified customer base. The counterparty default risk is limited by the company’s policy of transacting only with highly rated counterparties, limiting total exposure levels with individual counterparties, and entering into master agreements that allow “net settlement.”

Current Status

Instead of the title “Current Status,” we could have substituted “The Evolution of the CRO.” At the outset of the ERM initiative, the Corporate Risk Management Group consisted of the CRO (part-time) and two full-time professionals. To date, the group has conducted more than 180 workshops and authored numerous internal reports on strategic risk management. Some of these reports were prepared in the normal conduct of business and were issued regularly. Other reports were requested ad hoc, such as the strategic risk management analysis of a voluntary retirement program at Hydro One that is summarized in the box insert.

From the end of 2003 until the present, there have been no full-time members of the Corporate Risk Management Group. The CRO devotes 20 percent of his time to this role, and his previous staff have been reassigned to other jobs, although they are occasionally “borrowed back” for certain specific high-risk ERM projects. This reduction in personnel is not a sign of failure, but rather of two notable accomplishments:

1. The transfer and generation of knowledge on strategic risk management throughout the organization has been so effective that strategic risk management is considered to be embedded in the various subsidiaries and divisions to such an extent that the need for extensive central planning, implementation, and monitoring is significantly reduced. As evidence of Hydro One’s success in making “risk management everyone’s responsibility,” in 2002 the Corporate Risk Management Group received the firm’s “Sir Graham Day Award for Excellence in Culture Change.”²⁰ In the words of the then CEO and President of the company,
   1. Thanks to this team, Hydro One is becoming a leader in enterprise risk management—a key best-practice in the energy industry, and a critical element of good corporate governance … This group’s progress to date has also garnered attention from other organizations. In fact, the risk managers from the World Bank and Toronto General Hospital have visited Hydro One to learn about our methods.
2. Hydro One has become a well-established company both internally and externally. In 1999 it was a “new” company operating in a market that was to be deregulated and it was scheduled for privatization through an IPO. Today Hydro One has more than five years of experience as an independent company. It has demonstrated its ability to compete in a market that had been deregulated (but is now moving toward more regulation), and its ownership structure is now considered stable. Thus, the extent to which Hydro One faces internal and external changes has been markedly reduced.

The CRO continues to provide support for senior managers and develop risk management policies, frameworks, processes, and other analyses as needed. But thanks to the success of the program, the demand for hosting numerous workshops and establishing a risk management culture is greatly diminished. In short, risk management and awareness has become a mature operation at Hydro One.²¹