Oil Spill Stains Risk Management’s Reputation
The BP oil spill disaster in the Gulf is obviously the result of a failure of both technology and regulation. However, the biggest culprit is a catastrophic failure of risk management.
The job of a risk manager is to hope for the best, but be prepared for the worst. That means putting emergency response systems in place to cope with a worst-case scenario.
It’s hard to imagine a scenario any worse than the one we are witnessing in the Gulf. An offshore oil rig explodes, killing 11 workers. The rig collapses into the ocean. Oil continues to gush from a deep sea well, threatening the Gulf coast, the Florida Keys and perhaps even the Eastern seaboard.
One makeshift solution after another is implemented, with BP officials offering no guarantees of success–essentially keeping their fingers crossed. The situation remains out of control, and the damage could be substantial–environmentally, economically and even politically.
Where was the risk management department in this mess? Where were the fail-safe systems? Why did it feel as if BP was making up its response as it went along the past few weeks?
Most importantly, how can we make sure something like this never happens again?
Some might simply say that catastrophes like this don’t happen very often at all. Indeed, the lack of frequency, combined with the immense severity potential for such exposures is why oil companies generally self-insure such liabilities in the first place. It would just be too expensive to transfer such risks, given the premium an insurer would have to charge to cover a major loss.
But that’s just the insurance side of the equation. Since oil companies literally pump money out of the ground, they can always count on their substantial cash flow to bail them out of any major exposure, including this one.
However, the risk management coin has two sides. One is insurance to pay claims and damage control costs, but the other is loss prevention. That’s where BP really let everyone down.
BP officials defended the company’s risk management preparation in a May 10 “Wall Street Journal” article (http://online.wsj.com/article/SB10001424052748704307804575234621987007784.html), essentially arguing that this scenario goes well beyond “worst case,” into the realm of unforseeable.
“You have here an unprecedented event. Never before have you seen a blowout at such depth and never before has a blowout preventer failed in this way,” according to a BP spokesman, Andrew Gowers. “The unthinkable has become thinkable, and the whole industry will be asking searching questions of itself.”
However, the Journal went on to report that “BP’s plan, as submitted to the Mineral Management Service, placed exceedingly low probabilities on oil reaching land in the event of a major spill. Even in the case of the worst spill, BP said, there was only a 3 percent chance that oil would come ashore after a month in any part of the Gulf other than Plaquemines, La., which juts into the Gulf south of New Orleans.”
This is a stretch. Could it be that just like the company figured it didn’t need to transfer the risk due to the unliklihood of such an event, it also held off on potentially expensive risk management measures because it was so unlikely, in BP’s view, that this scenario could take place?
I am not throwing risk managers under the bus here. It’s quite possible the BP risk manager wanted a more reliable loss prevention system in place, but was overruled by cost considerations, or less risk-averse senior executives. Getting to the bottom of how BP handled risk management internally is a job for federal investigators to uncover.
In the meantime, we’re obviously not going to rid our country of its oil addiction anytime soon. Nuclear power, even if it is enthusiastically accepted (and that is far from certain), will take years to make a significant impact. Wind power is minuscule compared to our energy requirements. And it’s unlikely Americans will accept the kinds of behavior-altering tax regimes to lower our consumption to any significant degree.
That means we’re going to need to keep drilling for oil–often in environmentally dicey places. President Barack Obama recognized that with his statement prior to the BP fiasco that he was open to more off-shore drilling.
But it’s clear that if we’re going to keep sticking straws into the Earth deep under the ocean to suck out more oil, we need to be better prepared to react if something–especially the worst possible thing–happens. There needs to be more vigilant, arm’s length regulation to make sure oil companies are better prepared, and that starts with more accountable risk management, of the enterprise-wide variety.
If we’re going to play with fire, we had better be prepared to put out the flames before they consume us all.
(NU Risk Management Editor Caroline McDonald also addresses the loss control implications of the BP spill in her blog at http://noriskzone.com/.)
Entries (RSS)
There’s one other possibility involving the risk management component not mentioned, maybe out of respect for the position of Risk Manager.
As indicated, it’s possible the RM wanted better controls, procedures in place with safety as the number one goal. It’s also possible the RM took the position of playing the odds, taking into account the cost of designing, testing and implementing a fail-safe procedure to deal with a worst cast scenerio, and determined the up-front cost of such a system was too expensive and would impact profits too much.
If this turns out to be the case, due to the loss of life, I would suspect criminal charges could be brought. This would be a sad day.
The platitudes offered by BP sound a lot like the excuses offered by the government for 911, and NASA for the Challenger disaster. The government intelligence community said no one could have predicted a terrorist would use an airliner to crash into a building, but Tom Clancy used one (actually a cargo jet) to crash into the Capitol Building during the State of the Union address in one of his novels several years before 911, so there was not the political will to implement strong passenger screening techniques in advance of 911.
I also remember seeing an early design rendering of the Space Shuttle showing a crew compartment which could be jettisoned and parachuted to earth in the event of a catastrophic failure during launch, but this feature was considered too expensive and it was dropped.
BP is saying such a catastrophic failure was unforseen. Really? What about IXTOC-1 blowout in 1979? The shear-ram BOP failed on this well also, but for a different reason. Water depth was less than 200 feet and it still took several months to shut down the leak by drilling relief wells. This was a much larger spill than the BP spill.
As a risk manager, I for one get tired of hearing that some catastrophic failure is risk management’s fault. I contend that most risk management departments readily identify potential catastrophic events and rank them in their “heat maps,” but that it is senior operations management (C-suite) that determines how to best prioritize, control, and allocate resources to plan (or not plan) for these possible hi-severity exposures.
Yes, this is a risk management failure (in the generic sense), but a failure at the uppermost levels of C-suite management. The job of risk manager is not to be (operationally) “prepared for the worst,” but it is to identify and make senior management aware of potential risks so they (senior management) can make more informed decisions. A risk manager generally does not have control of operational assets or any authority to mobilize them.
To me, failure to effectively plan for this type of relatively foreseeable catastropic event is criminal, both at the BP senior management level, and even possibly at the regulatory level. Further, BP’s failure to adequately plan sets the oil industry back decades in their battle to open up additional off-shore drilling areas.
Instead of trying to defend individual “risk managers,” I read the article as an indictment of the failure of the C-level suite to embrace risk management and its concepts. Risk aversion is always overruled by greed and a rampant failure to learn from previous mistakes. Hubris is a fault that we can no longer tolerate in the world. We have made too mistakes in the past and have failed to learn from them.
What we should being doing is a review, discussion, and analysis into how we instill a sense of urgency in the C-level suite that we need to review all possibilities and try to identify the “Black Swan”. I would hope that this incident would force all organizations, both non-governmental and governmental, to develop and practice Business Continuity Planning.
Alasm I do not have that much faith in our “leadership”.
Certainly a C-level failure, I agree. I wonder at what level senior management includes their risk management department? If nothing else, this could be a strong case for C-level involvement of risk management. As Carlos indicated, risk management could have been trumped in some of the fail-safes due to management’s concern over costs.
It’s obvious they’re winging it right now. That’s a failure at ALL levels in the company. Yet it concerns me that risk management will bear the brunt of the blame because senior management isn’t going to do the right thing and take ownership of their own bad decisions.
Carlos came close to the answer here–but not quite. The BP disaster is a classic example of the ongoing need to merge risk management with quality management (as defined by Deming, Juran, et al).
Carlos — like so many others — speaks in terms of “procedures” when risk managers (and all others) need to speak (and think) in terms of “processes” and “systems”. Quality management differentiates “common cause variation” (normal variation in a process that requires no attention) from “special cause variation” (abnormal variation in a process that needs to be addressed immediately!).
Quality management tests processes on a small scale before they are produced on a major scale. This testing process could have (should have) determined that the BOP (Blow Out Preventer) was inadequate for the conditions found in the drilling process at this high-pressure drilling site.
Quality management principles coupled with risk management principles is what is needed. This is continually ignored by too many RM professionals.
Now is the time for RIMS to resume their Quality Score Card — not necessarily for brokers, TPAs, and carriers –but for THEMSELVES and for management of their OWN organizations’ operations and risks.
It appears the tool pusher didn’t activate the shear ram on the BOP. He’s in Heaven now, so we can’t ask him about his thought sequence. The location of the platform makes it difficult to impossible to read all process logs. Since they were capping a completion, it’s unlikely they took a kick, but that’s always possible. Was the mud replaced? How deep was the casing in relation to TVD? Were any ROV’s taken down? What was the status of the riser?
To readers who don’t immediately recognize the terminology, the approximate cost of this hole would be $100 million, and step 1 above could cost $20 million to 100% of the completion.
The risk management aspect of this occurrence, as discussed above, is immaterial.
Well, here we go again with the finger pointing, just like the BP executives did in front of the Congressional inquisitors. What we have here is a Black Swan, to use Nassim Nicholas Taleb’s phrase. Such things are never supposed to happen, not on this planet, and not in our lifetime. But, there it is.
What needs to be done now is (1) clean up the mess, (2) figure out how it happened, and (3) brace ourselves for the next Black Swan. How risk managers can take Black Swans into account in their risk assessments is a matter of conjecture, but finger pointing after the fact leads nowhere.
Joe Skeptical may have a point IF the tool pusher didn’t activate the shear ram on the BOP, but the accounts I’ve read indicate a change in normal protocol for this process in an effort to speed up the process due to a pending completion party or some such nonsense. Was the tool pusher and rig floor crew killed or did they survive? I don’t know.
This information may be out of date as it’s from an earlier account I read elsewhere, so don’t take it to the bank, but supposedly, it’s normal procedure to cement the cap, then replace the drilling mud in the riser with seawater. BP rec’d approval from the Govt Minerals Dept to replace the drilling mud in the riser with seawater before Halliburton performed the final cementing to save a step and speed up the process. This reduced the downhole pressure and resulted in the blowout.
Speculation was the earlier cementing operation by Halliburton done using a “hotter” cement mix to speed up the process at the direction of BP may have caused some methene hydrate to “melt” causing an extreme increase in downhole pressure, so when the seawater replaced the drilling mud, the reduction in weight couldn’t contain the well. Still, if the other BOP’s had functioned properly, they should have contained the kick.
If a lowly risk manager goes to the senior executives with an expensive suggestion to manage this type of situation, you know what they are going to tell him? Risk manage this!
What’s truly fascinating is to discern all previous comments / recommendations to determine if they are reactive measures or not (as opposed to proactive measures) — and to contrast each with those measures discerned to be proactive. Needless to say, risk management and quality management disciplines CONSISTENTLY help us to be proactive — and thereby help prevent a disaster from occurring. My sense is most of the above comments so far are based principally on reactive measures after the fact, not proactive actions in advance.
Here are some brief comments — all relating to the management of the BP disaster PROACTIVELY. They are based on comments of a friend who has decades of experience in exploration and production in the “oil patch”. They are actions that should have been taken BEFORE any adverse outcomes occurred:
(1) Casing was run and cemented but the cement job was evidently not good because it was contaminated by the oil and gas in the formation — a common occurrence BUT IT WAS NOT PROPERLY TESTED FOR INTEGRITY.
(2) A second cement plug was placed above the first cement job somewhere in the casing. A FINAL CEMENT PLUG THAT IS ROUTINELY PLACED ABOVE THE SECOND PLUG WAS NOT PERFORMED.
(3) Instead, A POOR DECISION WAS MADE TO CONVERT THE MUD SYSTEM TO SALT WATER to save the mud for the next well — and to save some time as well.
(4) As cement, oil, and expanding gas flew up the casing, it made the blowut equipment inoperable. Importantly, THE BLOWOUT EQUIPMENT HAD BEEN TESTED — AND FAILED ITS TESTS — BUT NO CORRECTIONS FOLLOWED.
(5) The decision to convert to salt water was opposed — but whoever was in charge for BP OVERRULED THE OBJECTION AND HAD THE FINAL SAY.
The conclusion I draw is that these steps — under the heading of both risk management and quality management — had they properly been taken proactively, the tragic outcome of loss of life and property could have been avoided. Proactive response trumps reactive response every time. Proactive actions HAVE to be our focus in whatever capacity or role we may find ourselves — as risk managers, quality managers, tool pushers, and any others with decision-making authority.
This whole thing is just a horrible tragedy.
This is a major major issue. This spill will have a lasting effect on aspects of life. From the fisherman who makes his living to the fish and all the other living in the sea. What really gets me upset is both BP and our goverment. They both act as if this is some walk in the park. This is and may be one of the worse events to ever happen to our enviroment. This is needs to be handled by people who feel this needs to be stopped ASAP. Who is responsible is not the issue right this second what the major issue is how do we stop this massive leak. BP and our goverment should be ashamed of themselves on how they handled this lets hope someone steps up to make this go away. Our children and the earth depend on it.
This is a tragedy in errors, a fault tree of the nth degree. Certainly it’s management’s fault. If they hadn’t overruled the standard procedure, this wouldn’t have happened. Period. Sure, the crew could have stopped drilling and walked of the rig as a safety protest. Would that happen in the real world? Not likely. It almost never happens even in the brick and mortar terra firma industrial sector, so it’s laughable to think of a work stoppage here, especially by subcontractors with minutes equating to tens of thousands of dollars.
Risk mamagers manage risk. They make suggestions to the top level or as you call it C-level management for procedural change that will reduce the risk of loss or exposure to the company and its employees, facilities, employees, etc. Unfortunately, they don’t usually have the STOP button in their control. As a risk manager I know top management had the final say and when production was critical, safety took a back seat to moving product. The “production with safety” illogic always overran “safe production” as far as I could see. Yet when all went wrong, everyone wanted to know why the Risk Manager didn’t prevent this. Hmm…
A thought that most have never considered on this ecological nightmare, one that I address on my blog…he first hurricane of the season that enters the Gulf of Mexico may become more powerful than ever expected, due to the oil on the water. The oil will block the natural release of heat from the water into the atmosphere during the nightly cooling cycle, and retain the heat in the water. Hurricanes feed upon heat and just a few degrees of water temperature increase may have a tremendous increase in the power of a hurricane. That has been a concern in past hurricane forecasting; wonder why nobody has been thinking of that here?
There has been talk about the oil being driven onto beaches and roads near the coast in the event of hurricanes or severe storms. But, nobody seems to have given thought to the fact that a hurricane picking up the oil laden water will drive it far inland mixed with rain, and as the water evaporates, will leave the oil as a combustible layer on everything it touches, severely raising the fire potential. Vegetation and frame dwellings will become highly combustible and any fire, unless immediately quelled, may lead to a conflagration of immeasurable proportion, one that could make the California wildfires look tame in comparison. And perhaps in highly populated areas as well!
And, as a final note, will the toxic rain destroy crops as well, or leave them so they cannot be harvested? Something else to think about.
This could be even worse than anything we have ever seen in our lifetimes, or ever will.