6 th September not protectively marked 1

Transcription

1 Establishing Risk Management processes in UK Nuclear New Build - (inc Enterprise Risk Management & Probabilistic Cost & Schedule Risk Analysis processes) 6 th September 2016 not protectively marked 1

2 Introductions Clive Randall - Head of Business Planning and Strategy Craig Brannigan Enterprise Risk Manager Why we are here? To share our experiences in the development of a risk management culture in a new nuclear organisation To learn from others experiences not protectively marked 2

3

4 The Moorside Project NUGEN - COMMERCIAL

5 NuGen Enterprise Risk Management 5

6 Enterprise Risk Management Enterprise Risk Management is a common framework applied by the business management and other personnel to identify potential events that may effect the enterprise, manage the associated risks and opportunities and provide reasonable assurance that the company s objectives will be achieved. Enterprise Risk Management Integrated Framework, [2004] Committee of Sponsoring Organizations of the Treadway Commission (COSO). All rights reserved. Used with permission. Document Number - Draft (Working Copy) NUGEN - COMMERCIAL 6

7 Risk Management Approaches Document Number - Draft (Working Copy) NUGEN - COMMERCIAL 7

8 Key Challenges For ERM Development In NuGen Cultural experience Mixed backgrounds and from a number of countries Shift approach and alignment as one NuGen Enterprise Risk Management Delivery to meet Financial Investment Decision (FID) whilst development of the organisation ongoing New organisation with rapid recruitment constantly changing dynamics 8

9 NuGen Risk Category Development Shareholder best practice Risk Category Commercial & Finance Corporate Affairs Strategy Project Management, Schedule & Costs Human Resources (Inc. Pension and Insurance Operations IT Governance and Ethics Procurement Health Safety and Quality Environment Security & Emergency Response 9 NuGen Exec sign off & appointment of category owners

10 ROLE Head of PMO & Process Sponsor for Risk Enterprise Risk Manager Risk Category owner Risk Owners Action Owners ERM Risk Responsibility Assignment Matrix Ownership of ERM for the Business Reviewing effectiveness of ERM in producing information to support management decisions Leading ERM at a business level Understanding of the status of the ERM processes within a category, Management of risk Categories and their contained risks Activities Provide updates on risks and actions with a defined risk Category Reviewing and prioritising Business level Enterprise Risks Reporting of Enterprise Risks A I I I Ensure that the risk is properly expressed and sufficiently understood Ensure expertise is provided to effectively assess and develop a suitable risk response Agree action owners R A A/R I I I A A C C R C A A C C C A R A R R A R A/R R A I C R C I ERMC (Function C I C of EMT) ERMF I C R C R Agree Risk Owners 10

11 ERM Process Map Manage Enterprise Risk Nominated Enterprise Risk Programme Risk Manager Enterprise Risk Management Forum Executive Management Team Management Forum Member Start Risk Logs EDRMS 1. Review relevant Risk Logs EDRMS Draft Enterprise Risk Report To Manage Risks 2. Collate high category risks and common risks 3. Review and update risks 4. Update Enterprise Risk Report 7. Review Enterprise Risk Report Enterprise Risk Management Forum / Executive Management Team Review Meeting EDRMS Enterprise Risk Management Report EDRMS EDRMS Enterprise Risk Report ToR 5. Hold ERMF meeting to review updated risks Bi-Monthly ERMF Meeting 6. Compile Enterprise Risk Report and issue 8. Can the report be approved? Yes End EDRMS Approved Enterprise Risk Management Report No 9. Conduct meeting to discuss actions Licence Conditions No Licence Conditions From Programme Management Risk Log Draft Enterprise Risk Report Enterprise Risk Report Enterprise Risk Management Report Manage Risk EDRMS EDRMS EDRMS EDRMS Document Number - Draft (Working Copy) NUGEN - COMMERCIAL 11

12 Alignment within Business Delivery 12

13 Risk Maturity Assessment (IRM Maturity) 13

14 Risk Maturity Past Now - Future Maturity 14

15 Next Steps NuGen Risk Management Review of enterprise and probabilistic risk management software packages & plan approval for deployment Develop probabilistic analysis on both FID and full project schedule Standard approach to risk embedded across all Enterprise Categories and Workstreams Improved capturing of mitigation across Categories External LFE 15

16 Project Schedule and Cost - Enterprise Risk Category 6 Steps to Schedule and Cost Probabilistic Risk analysis 16

17 Step 1, Assess Risk Events Probability/Impact table 17

18 Step 1, Assess Risk Events Probability/Impact table Deep Red Very Extreme Risks of very high magnitude will very rarely, if ever, have an Accept response strategy. They must be escalated. Response plans must be developed and implemented as a key priority Red Very High risks are an area of focus. They will normally be escalated. Response plans must be developed and implemented as a key priority Pink High risks are an area of focus. Response plans must be developed and implemented as a key priority Yellow Medium risks action should be taken to treat yellow risks, if higher priority risks have response strategies implemented Grey/Green Very Low to Low risks normally have an Accept strategy and their expected impact should be incorporated into the schedule and cost estimate.

19 Step 2 Assess risk levels Risk can be assessed at inherent, current or residual levels. The inherent risk level is the level of risk before a response is put in place. Inherent risk is typically very difficult/impossible to estimate The current risk level is the level of risk as it stands at the time of analysis. The current level of risk is over and above what has been accounted for in the schedule and cost estimate. To avoid double counting, assume that any risk response already included in the schedule and cost estimate will be carried out successfully The residual risk level is the level of risk that would be achieved if any proposed risk response actions that are not accounted for in the schedule and cost estimate are successful The current risk level should be used to assess the contingency required by the project. This is because the schedule and cost estimate do not take account of any proposed actions and use of the residual risk level against the current schedule and estimate will underestimate total project time to completion and cost. Residual risk is estimated in order to assess the potential effectiveness of risk response actions and to prioritise response strategies where appropriate.

20 Step 3: Consider Variances Schedule variance each schedule activity has a variance, which is the estimating uncertainty around the activity s duration. The variance is the uncertainty around the duration which is not covered by specific risks Cost variance each cost element has a variance, which is the estimating uncertainty around the cost, and is intended to cover the uncertainty around the cost element which is not covered by specific risks Note: The cost variance should not include the uncertainty that results from schedule risk. This is because the risk model already represents the cost of delays. Variance is often expressed as a P10, Most Likely and a P90 for each cost or duration.

21 Step 4: Model development Associate risks to schedule activities risks in the risk register are associated with one or more activities, so that the risk model properly reflects the impact of the risks both in terms of the critical path and timing Association of risks to the cost estimate a risk s cost impact is associated with an element(s) in the cost estimate Conditional logic optionally some logic that describes how the project would react to certain risk events. For example: if the delivery of a major critical item is delayed a couple of months the project would take proportionally longer and be more expensive Weather logic optionally some logic that describes how weather would affect the project. Metrology data can be used to express the probability of downtime.

22 Step 4: Model development Correlation the final part required by the risk analysis is to express the correlation between all the other parts of the risk assessment. Correlation arises in real life when uncertain factors have common causes. For example: the variance around the productivity of the earthworks in both locations are correlated, because they both use the same mix of plant and labour and same contractor Correlation is expressed as a strength between 0% and 100%.

23 Step 5 Running the Model Primavera Risk Analysis uses Monte Carlo simulation to calculate the logical effect on the project of the risk assessments. The risk model is verified by a risk analyst and the project team: this verification takes the form of logic checks by the project team, and also sharing of the preliminary outputs until the project team is comfortable that the model does represent the project

24 Step 5 Running the Model Once the model is verified, the model undergoes a final run. The outputs of the risk model include: Overall contingency for schedule and cost (at P10, P50, P90, for example). Aggressiveness of the base estimates if contingency were not applied, how much chance the project would have of meeting the base schedule and budget? Cumulative probability curves (S-curves) for schedule and cost. These curves provide a visual justification for the overall contingency and aggressiveness figures Tornado charts, showing how much each of the top risks contributes to schedule and cost. These tornado charts are calculated by comparing the overall result with an alternative result that assumes the risk does not exist Risk register, supplemented with the contribution of each risk to the overall contingency Probabilistic cost breakdowns, which show how (on average) the overall contingency distributes itself across the cost estimate structure Probabilistic cost phasings, which show how (on average) the overall contingency distributes itself across the timescale of the project (by month, for example.

25 Step 6 the results The risk analysis report includes all the assumptions behind the risk model, the results of the risk model, and key interpretations of those results, so the report provides meaningful information on the risk and how it will be managed After the base case has been modelled different scenarios may be simulated. The scenarios may eliminate some risks but they also may introduce new risks and these must be identified and included in the scenario analysis Results from the scenarios are compared with the base case to establish whether or not any advantage is gained in undertaking the work differently.

26 Any questions? Document Number - Draft (Working Copy) NUGEN - COMMERCIAL 26

27 For more information visit our website or 27