1. 1 Introducing Enterprise Risk Management (ERM) - The KOC Experience November 2012 Khaled Al-Awadhi Risk Management Team Kuwait Oil Company

2. 2 www.kockw.com Index ► Introduction Why we are doing it? Doing the same thing Behavioral aspects in ERM ► Risk - key definitions ► Implementation journey Risk policy Enterprise Risk Management (ERM) Manual ERM Pilot ERM Rollout ► Way forward

3. 3 www.kockw.com Introduction ► Global demand for improved visible governance ► Examples of risks facing large companies ( both major and complete collapse …. – Rawdatain Gas Well incident (KOC) – Bank failures Why we are doing it?

4. 4 www.kockw.com KOC adopted it because of KPC directives and because of its benefits Benefits: – Demonstrate improved governance to all stake holders – No surprises / Improved preparedness – Risk reduction/treatment – Improved confidence in decision making – reduce risk to company objectives Continue…..

5. 5 www.kockw.com ► Are you really doing the same thing? – The scenario changes! – The person doing it changes!! – The objectives change!!! – Unknown unknown !!!! Doing the same thing ► Can you do the same thing again and again and expect the same result? Continue…..

6. 6 www.kockw.com ► Can personality types affect risk perception? ► Can past experience affect risk perception? ► Can laws affect risk perception? ► What else? Behavioral aspects of ERM Continue…..

7. 7 www.kockw.com KOC’s Risk Exposure 7 Global Oil Market Global/ Domestic Products Market KOC KPC Sister Companies Exposure Barriers

8. 8 www.kockw.com Macro to Micro (and back again) Leaders StrategicTactical Activity Workforce Risk Profile Leaders need firm information on which to base decision making and objective setting. Risk profiling does this. Work force needs strategic information to make right detailed operational planning.

9. 9 www.kockw.com Risk - key definitions Continue…..

10. 10 www.kockw.com Risk – framework (AS/NZ 4360: 2004) Standard Continue…..

11. 11 www.kockw.com Implementation Journey 1.KOC Risk Policy 2.ERM Procedure 3.ERM Pilot 4.ERM Rollout 5.Way forward

12. 12 www.kockw.com Implementation Journey … KOC Risk Policy

13. 13 www.kockw.com Implementation Journey … KOC Risk Policy Consistent with international best practice Recognizes that risk is inherent in our business Risk Management is fundamental to achieving our objectives Visibility will help to monitor actions Improve decision making

14. 14 www.kockw.com ERM Framework ERM Policy Organisation & Capability ERM Process Acceptance & Appetite Communication Risk Register Stakeholders Operational Functions Enterprise Risk Management System Assurance

15. 15 www.kockw.com

16. 16 www.kockw.com Implementation Journey … ERM Manual The ERM Manual covers the following key elements ……..RM Manual Contents 1.0INTRODUCTION 1.1Scope 1.2Background 2.0RISK MANAGEMENT FRAMEWORK 2.1Risk Management Policy 2.1.1Accountability 2.1.2Guidance 2.2Organisation & Capabilities 2.2.1General Roles & Responsibilities 2.2.2Capabilities 2.3Risk Management Process 2.3.1Establish Context 2.3.2Assess the Risk Exposures 2.3.3Define Risk Management Plans 2.3.4Implement Plans 2.3.5Monitoring & Review

17. 17 www.kockw.com Implementation Journey … ERM Manual The ERM Manual covers the following key elements ……..RM Manual Contents 2.4Risk Philosophy 2.4.1Risk Acceptance 2.4.2Risk Appetite 2.5Communication 2.5.1Risk Profiling 2.5.2Risk Reporting 2.6Risk Register 2.7Assurance 2.7.1Action Tracking 2.7.2Audit 2.7.3Monitoring 2.7.4Confirmation of Performance 2.7.5Management Review 3.0STAKEHOLDER REPORTING 4.0MANAGEMENT IMPLEMENTATION ACTIVITIES

18. 18 www.kockw.com Implementation Journey … Risk Matrix RISK CONSEQUENCE Cost of Event Profit Reduction Health and Safety Natural Environment Social or Cultural Heritage Community, Government, Reputation, Media Legal Consequence What are the worst casecredible scenarios for each category of consequence (target)? Consequence What are the worst casecredible scenarios for each category of consequence (target)? Probability How likely is it to occur / reoccur? How effective are the controls we have in place? Probability How likely is it to occur / reoccur? How effective are the controls we have in place? Consequence What are the worst casecredible scenarios for each category of consequence (target)? Consequence What are the worst casecredible scenarios for each category of consequence (target)? Probability How likely is it to occur / reoccur? How effective are the controls we have in place? Probability How likely is it to occur / reoccur? How effective are the controls we have in place? Consequence What are the worst casecredible scenarios for each category of consequence (target)? Consequence What are the worst casecredible scenarios for each category of consequence (target)? Probability How likely is it to occur / reoccur? How effective are the controls we have in place? Probability How likely is it to occur / reoccur? How effective are the controls we have in place? Impact Likelihood 1 - Incidental 2 - Minor3 - Moderate4 - Major5 - Severe 1 - Frequent MediumHigh Very High 2 - Likely MediumHigh Very High 3 - Possible Medium High Very High 4 - Unlikely LowMediumHigh High* 5 - Rare Low Medium High* 6 - Very Rare Low Medium High

19. 19 www.kockw.com Risk Hierarchy Risk register allows “drill down” from corporate level risks to detailed exposures www.kockw.com

20. 20 www.kockw.com Risk Profile The risk hierarchy allows senior managers to understand the current level of exposure and the trend over time. From this they can set improvement objectives for the following period. Operational Financial Human Resources Health, Safety & Environmental Governance, Reputation & Compliance Technical Services Directorate General Management North Kuwait Directorate E&PD Directorate West Kuwait Directorate South & East Kuwait Directorate Administration Directorate 0 10 20 30 40 50 60 1st Qtr2nd Qtr3rd Qtr4th Qtr Critical Intolerable Broadly Tolerable Acceptable Corporate Risk Profile Areas of Risk Areas of Exposure & Control Planning & Gas Directorate

21. 21 www.kockw.com Implementation Journey … ERM Pilot Workshops held in two Groups Risks Identified Risks Analyzed Actions Identified Responsibility assigned Risk Register prepared

22. 22 www.kockw.com Implementation Journey … ERM Roll out Implementation of ERM in all groups in KOC. Risk Review workshop for LC KOC Risk Register Training of Risk Management for Managers General Awareness Super Users RM Team capability building Because of the unique case of Ahmadi Hospital, building the Risk Register was done alone not with the company roll out.

23. 23 www.kockw.com Embed ERM in KOC Continuous updated vision of Risks facing KOC is available to leadership to support risk aware decision making. » Compile and analyze risk profile » LC Risk review » Communicate risk profile to stakeholders Support KPC Enterprise Risk Management Project. Modeling of key risks Proactive support to Auditors as partners, to find opportunities for improvement We are now linking the internal audit report with Risk Register. This year we will include London Office Risks to the Risk Register. ERM Way forward

24. 24 www.kockw.com Basis : Survey & Audits Basis : Work Shops Basis : Annual Update KPM : Risk Index (Treated) is linked to SMAIP ERM Profile in KOC

25. 25 www.kockw.com