BP 2012 Annual Report Download - page 120

Corporate governance
BP Annual Report and Form 20-F 2012
118
BP’s risk management system
BP’s risk management system focuses on three levels of activity:
Day-to-day risk management – the system helps facilitate day-to-day
risk management in the group’s operations and functions, with the
approach varying according to the types of risk faced. Risks are to be
identified and managed, and actions to improve the management of risk
are to be put in place where necessary. The aim is to address each
different type of risk as well as we can – promoting safe, compliant and
reliable operations.
Business and strategic risk management – for BP’s businesses and
functions, risks arising are to be collated periodically, risk management
activities are to be assessed, and any necessary further improvements or
actions are to be planned. The system is designed to facilitate this by
incorporating a standardized form called the risk management report
(RMR), for businesses and functions to report consistently the risks they
face for management consideration, challenge, resource allocation and
intervention. This enables the integration of risk into key business
processes such as strategy, planning, performance management,
resource allocation and project appraisal.
Board, executive and functional oversight – the system facilitates
executive and board oversight and governance over the management of
significant risks. It requires executive team level involvement in the
finalization of risk management activities and improvement plans for the
group’s most significant individual risks. Using the consistent bottom-up
risk identification and assessment process, coupled with top-down
executive overview, the system requires that the most significant risks
requiring oversight are identified. Oversight of the management of these
risks is to be provided through regular review by the board or one of its
committees.
BP’s risk management system assists in:
t Understanding the risk environment for input into the strategy.
t Understanding which risk types we operate with, given the strategy.
t Identifying and assessing the specific risks and the potential exposure
they may represent.
t Decision-making on how best to deal with those risks to manage
overall potential exposure.
t Active management of identified risks.
t Reporting to management and the board about how those risks are
managed, and monitoring of potential exposure.
t Obtaining assurance over the effectiveness of the management of
those risks.
t Intervening for improvements in the management of those risks
where necessary.
t Considering the effect of the external environment and business
activities on the principal activities of BP’s risk management system.
The willingness to take and appropriately manage certain risk is
fundamental to the success of any commercial enterprise. For example, in
our upstream business we consciously place significant amounts of
capital at risk in exploring for new hydrocarbon resources. Where this
exploration is successful, we would generally expect it to lead to future
increases in our proved reserves and future cash flows. However,
exploration expenditure may not yield adequate returns, for example in the
case of unproductive wells or discoveries that prove uneconomic to
develop.
Risk management and reporting in 2012
During 2012, BP’s segments, strategic performance units and functions
prepared RMRs. The most significant risks were organized into common
categories – strategic risks, safety and operational risks and compliance
and controls risks – so they could be assessed and reported up the line in
the standardized form. This helped provide an overall data set of the key
risks identified, an assessment of their potential impact and likelihood on a
consistent basis, information on how they were being managed and any
actions planned or in progress to improve the management of risk. Based
on these RMRs, together with additional executive overview, a single
group RMR has been prepared. Those risks identified on the group RMR
requiring particular group-level oversight in the coming year are allocated
to specific board and executive committees for oversight and monitoring.
These are discussed below. Also see Risk factors on pages 38-44 for a
description of the material risks we face in our business.
Executive and board oversight of risk
The executive and board examine particular group risks both on a periodic
basis and as part of the development and review of the annual plan. The
board also conducts an annual review of the risk management and internal
control systems as required by the UK Corporate Governance Code.
During the year there is flexibility to change which risks have been
identified as requiring particular oversight and which have been allocated
to the executive or board, in the event there are any changes to the
internal or external environments or events arising.
The executive committees monitor the group risks in the following areas:
t ETM for strategic and commercial risks.
t GORC for health, safety, security and environment and operations
integrity risks.
t GFRC for finance and trading risks.
t GDC for financial reporting risk.
t GPC for people risks.
t RCM for risks related to investment decisions.
t GECC for ethics and compliance risks.
Risk management: from operations to the board
Occurs periodically at
board level
Results in oversight of
group risks
Occurs periodically at executive
and function levels
Results in governance over
group risks
Occurs periodically at business
and function leadership levels
Results in integration of risk
into key business processes
Occurs at operations
and functions
Promotes safe, compliant
and reliable operations
Occurs periodically at
board level
Results in oversight of
group risks
Occurs periodically at executive
and function levels
Results in governance over
group risks
Occurs periodically at
board level
Results in oversight of
group risks
Occurs periodically at
board level
Results in oversight of
group risks
O
c
cu
r
s
p
er
i
o
di
c
al
l
y
at
e
xe
cu
tiv
e
a
n
d
fu
n
ct
i
on
le
ve
l
s
Re
s
u
lt
s
i
n
g
ov
e
rn
an
ce
o
ve
r
g
r
o
u
p
r
is
k
s
O
c
cu
r
s
p
er
i
o
di
c
al
l
y
a
t
b
o
a
rd
l
e
v
e
l
Re
su
l
t
s
i
n
o
ve
r
si
g
ht
o
t
f
g
r
ou
p
r
isk
s
Board oversight
Executive and
functional oversight
Business risk and
strategic risk management
Day-to-day risk
management