BP 2009 Annual Report Download - page 22

BP Annual Report and Accounts 2009
Business review
20
Major project delivery
Successful execution of our group plan depends critically on
implementing the activities to deliver the major projects over the plan
period. Poor delivery of any major project that underpins production
growth and/or a major programme designed to enhance shareholder
value could adversely affect our financial performance.
Digital infrastructure
The reliability and security of our digital infrastructure are critical to
maintaining our business applications availability. A breach of our digital
security could cause serious damage to business operations and, in
some circumstances, could result in injury to people, damage to assets,
harm to the environment and breaches of regulations.
Business continuity and disaster recovery
Contingency plans are required to continue or recover operations
following a disruption or incident. Inability to restore or replace critical
capacity to an agreed level within an agreed timeframe would prolong
the impact of any disruption and could severely affect business
and operations.
Crisis management
Crisis management plans and capability are essential to deal with
emergencies at every level of our operations. If we do not respond
or are perceived not to respond in an appropriate manner to either an
external or internal crisis, our business and operations could be
severely disrupted.
People and capability
Successful recruitment of new staff, employee training, development and
long-term renewal of skills, in particular technical capabilities such as
petroleum engineers and scientists, are key to implementing our plans.
Inability to develop the human capacity and capability across the
organization could jeopardize performance delivery.
Treasury and trading activities
In the normal course of business, we are subject to operational risk
around our treasury and trading activities. Control of these activities is
highly dependent on our ability to process, manage and monitor a large
number of complex transactions across many markets and currencies.
Shortcomings or failures in our systems, risk management methodology,
internal control processes or people could lead to disruption of our
business, financial loss, regulatory intervention or damage to our
reputation.
Our systems of control
The board is responsible for the direction and oversight of BP. The board
has set an overall goal for BP, which is to maximize long-term shareholder
value through the allocation of its resources to activities in the oil, natural
gas, petrochemicals and energy businesses. The board delegates
authority for achieving this goal to the group chief executive (GCE).
The board maintains five permanent committees that are
composed entirely of non-executives. The board and its committees
monitor, among other things, the identification and management of the
group’s risks – both financial and non-financial. During the year, the
board’s committees engaged with executive management, the general
auditor and other monitoring and assurance providers (such as the group
compliance and ethics officer and the external auditor) on a regular basis
as part of their oversight of the group’s risks. Significant incidents that
occurred and management’s response to them were considered by the
appropriate committee and reported to the board. (See Board
performance report on pages 69 to 80.)
The GCE maintains a comprehensive system of internal control.
This comprises the holistic set of management systems, organizational
structures, processes, standards and behaviours that are employed to
conduct our business and deliver returns for shareholders. The system is
designed to meet the expectations of internal control of the Combined
Code in the UK and of COSO (committee of the sponsoring organizations
for the Treadway Commission) in the US. It addresses risks and how we
should respond to them as well as the overall control environment. Each
component of the system has been designed to respond to a particular
type or collection of risks. Material risks are described within the Risk
factors section (see pages 18 to 20).
Key elements of our system of internal control are: the control
environment; the management of risk and operational performance
(including in relation to financial reporting); and the management of
people and individual performance. Controls include the BP code of
conduct, our leadership framework and our principles for delegation of
authority, which are designed to make sure employees understand what
is expected of them.
As part of the control system, the GCE’s senior team – known
as the executive team – is supported by sub-committees that are
responsible for and monitor specific group risks. These include the group
operations risk committee (GORC), the group financial risk committee
(GFRC), the group people committee (GPC), and the group disclosures
committee (GDC), which reviews the disclosures, controls and
procedures over reporting.
Operations and investments are conducted and reported in
accordance with, and associated risks are thereby managed through,
relevant standards and processes. These range from group standards,
which set out processes for major areas such as safety and integrity,
through to detailed administrative instructions on issues such as fraud
reporting. The GCE conducts regular performance reviews with the
segments and key functions to monitor performance and the
management of risk and to intervene if necessary. People management
is based on performance objectives, through which individuals are
accountable for delivering specific elements of the group plan within
agreed boundaries.