Classification: Internal Understanding and Handling Residual Risks SPE Annual Technical Conference, Denver 2011 John Zhao, MSc.

Classification: Internal Simple Risk Management The loop may continue for a long time, but when and where the Risk Management should STOP ?

Classification: Internal Thorough Risk Identification ? “Actually, I'm not sure if a risk assessment would have caught this one”. Borrowed from CartoonStock Missed Risks ≠ Residual Risks Secondary Risks ≠ Residual Risks Residual risks are net risks left over after safeguards (risk response actions) have been implemented.

Classification: Internal What is a Residual Risk? P10P90 Simulation through Risk Analysis With 80% confidence How about P1 to P10 And P90 to P99 ?

Classification: Internal Common Problems with Residual Deliberately Hidden & Covered Hard to detect so dangerous. Ambiguous Acceptable Level “Tolerable” risks not defined Ignored as Probabilities low Lacking Discrete Simulation Unwillingness of Risk Taking Psychological Barrier to risks

Classification: Internal Residual Risk Handling Principles Zero risk in any activity is not achievable ; therefore → The risk tolerance, after mitigating actions, has to be defined by management; → Management may decide not to reduce residual risk further but to accept it; → The additional benefit of reducing residual risk level may not outweigh its cost;

Classification: Internal Process of Handling Residual Risks Re-Rank Residual risk P x C Closed Effectively Lower Not Effective Residual Risk Response Action Planning RESIDUAL Risk Treatment Monitor Action Effects Insurance; Reserve; Accepting Above Risk Tolerance Level Benefit vs. Costs Simulation Negative Positive

Classification: Internal Classic Risk Movement Example UnacceptableWorkable Acceptable High Impacts I High Probability R ? Risk: Incomplete modules may be shipped for offshore installation, resulting in increased costs, due to lack of stringent onshore QC. Initial Ranking: P5 x C4 =20 Action: A dedicated QC inspector will reside in module Fab Yard for checking / signing off. Monitor: Effectively lowed risk. Residual Ranking: P2 x C4 = 8 Residual Level still not desirable. But it is accepted with $x Million risk contingency for offshore repairs.

Classification: Internal Decision-making Rules In the pessimistic scenarios, observe following rules: - ERM policy shall define residual risk acceptance criteria; - Insurance and emergency preparedness must be always in place; - Endeavor to lower initial risks below tolerance level; - Use ALARP and FMEA methods for quantitative comparison; - Include both Discrete and Continuous simulations in decisions; - Accept residual risks if action costs higher than benefits;

Classification: Internal Residual Risk using Discrete Simulation

Classification: Internal Quantifying Residual Risks Quantifying Residual Risk Impacts -Extreme value analysis - Rayleigh distribution -Double Triangular Distribution -Discrete distribution for Portfolio management -Rare event Risk Analysis – Fault Trees / Psychological Judgements

Classification: Internal Funding for Residual Risks Residual Risk Fund, (Leftover / Rare) Contingency (risk) Allowance ( experience) Base Estimate (quantity) Business Project Team Validity of Low Probability High Consequence Estimates -Residual risk funds built up at Aggregated Portfolio level; -Check and validate key assumptions / simulation model; -Use common business sense to overcome psychological fears;

Classification: Internal Defining Residual Risks “Residual risks primarily are leftover risks that are still above tolerable levels even after effective risk responses actions have been implemented”. Handling Residual Risks “Using good business common sense and quantified contingency plan to overcome psychological fears of residual risk events. Managing Residual Risks “It is the amalgamation of art and science, psychological judgement and technical reasoning, qualification and quantification processes. Residual Risks - Summary

Classification: Internal Understanding and Handling Residual Risk Presenters name: John Zhao Presenters title: Quality and Risk Manager address: Thank you