Is Protecting the Balance Sheet Enough? Joseph W. Mayo J. W. Mayo Consulting, LLC

Transcription

1

2 Is Protecting the Balance Sheet Enough? Joseph W. Mayo J. W. Mayo Consulting, LLC

3 Agenda ERM Problems High Profile Risk Management Failures General Motors (GM) ignition switch failure Deepwater Horizon Oil Spill Anthem Data Breach ERM Improvement Opportunities

4 ERM Problems ERM s job is to protect the balance sheet Normalized deviance is a warning sign of impending disaster Improper valuation of risk impact ERM functions at a tactical instead of strategic level

5 High Profile Risk Management Failures

6 General Motors Switch Failure 2001: GM detects the defect during pre-production testing of the Saturn Ion 2003: Technician notes and corrects the ignition switch problem 2004: GM recognizes the defect once again March 2005: GM rejects corrective action, deemed too costly and would take too long May 2005: GM engineer advises the company to once again take corrective action, but the proposal is ultimately rejected July 2005: First death attributed to faulty ignition switch April 2007: An investigation links a fatal crash to the ignition defect, but regulators do not conduct an investigation

7 General Motors Switch Failure 2012: GM identifies four fatalities attributable to the ignition switch defect End of 2013: GM determines that the faulty ignition switch is to blame for at least 31 crashes and 13 deaths Basu, T. (2014, March). Timeline: A History Of GM's Ignition Switch Defect. National Public Radio, ().

8 General Motors Switch Failure By 2015 the failed ignition switch resulted in 51 deaths and cost GM $4.1 billion (Isidore, 2015) The recall cost is $1,077 per vehicle. Had action been taken early in 2005 the recall could have been confined to as few 4,100 Saturn Ion resulting in a total recall cost $4.4 million Even if action was taken late in 2005 the recall would have affected no more than 216,800 vehicles with a maximum recall cost of $233 million Actual impact is nearly 20 times the worst case scenario in 2005 Proper valuation of Enterprise risks is often overlooked Unfortunately the risk planning horizon is all too often the next quarterly or annual report Proper impact assessment and valuation would likely have provided the incentive needed to initiate the recall in 2005 instead of ten years and 51 deaths later

9 Deepwater Horizon Oil Spill Deepest oil well in history at more than 35,000 feet Spill cleanup procedures and technology in 2009 were essentially unchanged since the 1960s Prior to the Deepwater Horizon disaster, BP considered deep water blowouts in the Gulf of Mexico a high-level risk

10 Deepwater Horizon Oil Spill BP s Oil Spill Response Plan presented worst case spill scenarios ranging from 28,033 to 250,000 barrels (Davis, 2012) Between 1937 and 2010 there were at least 59 oil spills ranging from 29,000 barrels to 6 million barrels BP s spill scenarios undervalued spill risk by more than 2,400% Average spill size of 59 spills was 741,000 barrels Top 10 of 59 spills ranged from 1-6 million barrels and averaged 2.3 million barrels U.S. DOI exempted BP's drilling operation from a detailed environmental impact analysis Three reviews of the area concluded a massive oil spill was unlikely (Eilperin, 2010) BP estimates the total cost associated with the spill is nearly $54 billion (Robertson, Schwartz, Pérez-Peña, 2015)

11 Anthem Data Breach Data breach in December 2014 January 2015 exposed personal information and health records of 80 million people Anthem will provide Identity Theft Repair Assistance, Credit Monitoring, and Child Identity Protection Combined costs for credit monitoring, identity monitoring, and restoration can range from $10 to $30 per individual per year (Stapleton, 2012) Credit monitoring cost is projected to be $1.3 billion Average cost for each lost or stolen record increased in 2015 to $154 (Ponemon Institute, 2015) If 10% of the records are compromised, data breach cost will increase by an additional $1.23 billion

12 Case Study Conclusion Protecting the balance sheet simply isn t enough Ignoring and normalizing safety and reputation risks can have catastrophic impact Improper impact valuation can lead to astronomical financial impacts Organizational culture that supports normalized deviance, ignores quantitative data, and drives tactical risk management is a recipe for disaster

13 High Reliability Organization (HRO)

14 HRO Characteristics Operate in environments where potential for disaster is high Reward system that rewards riskmitigating behavior Very high risk appetite and tolerance Top priority is effective performance Avoid disasters through collective learning Develop a culture of reliability Extensive process auditing exists Quality standards that exceed referent standards Correctly assess risk impact Strong command and control system that includes migrating decision making, redundancy, decision makers have big picture perspective, and formal rules and procedures Strategic heavily influenced by organizational culture Tactical independent of culture, can be directed HRO examples: Aircraft carrier flight deck, manned spaceflight, nuclear power plants

15 ERM Improvement Opportunities Establish and foster a risk aware culture ERM is more than just protecting the balance sheet Consider safety and reputation risks along with financial risks Avoid normalized deviance Embrace tenets of HROs Effectiveness, reliability, collective learning, and proper risk valuation Effective ERM must include both strategic and tactical elements that operate in conjunction with one another

16 Thank you! Joseph W. Mayo TaoOfRisk

17 References Basu, T. (2014, March). Timeline: A History Of GM's Ignition Switch Defect. National Public Radio, (). Isidore, C. (2015, February). GM's Total Recall Cost: $4.1 billion. CNN Money, (),. Retrieved from Davis, M. (2012). Lessons Unlearned: The Legal and Policy Legacy of the BP Deepwater Horizon Spill. Washington and Lee Journal of Energy, Climate, and the Environment, 3(2), Eilperin, J. (2010). "U.S. exempted BP's Gulf of Mexico drilling from environmental impact study". The Washington Post (The Washington Post Company). Robertson, C., Schwartz, J., & PÉREZ-PEÑA, R. (2015, July 2). BP to Pay $18.7 Billion for Deepwater Horizon Oil Spill. The New York Times, p. 1. Stapleton, T. (2012). Data Breach Cost - Risks, costs and mitigation strategies for data breaches. Schaumburg, IL: Zurich American Insurance Corporation. Ponemon Institute. (2015) Cost of Data Breach Study: Global Analysis. Traverse City, MI: Ponemon Institute LLC.

18