0 Introduction

NOTE HH Sheikh Mohammed bin Rashid Al Maktoum, Vice President and Prime Minister of the United Arab Emirates and Ruler of Dubai, inaugurates the 200 MW second phase of the Mohammed bin Rashid Al Maktoum Solar Park in Dubai.

0.1 Utilities guide for the development and implementation of enterprise risk and resilience management (ERRM)

Electricity, gas and water utilities across the world are facing an array of challenges. They are expected to manage risks to their services, meet their obligations and manage existing liabilities while improving organizational resilience in order to resist, respond to, and recover from unexpected events. Governments, regulators, customers and the public expect utilities to maintain services, and when a service is interrupted, quickly fix the problem while minimizing the impact.

Meeting these expectations is challenging and requires utilities to adopt a proactive approach to risk and resilience management – identifying risks, understanding consequences and the speed at which these can occur, and taking appropriate short-, medium- and long-term actions to increase organizational resilience.

This drives requirements for continuous development in the skills of utilities leadership and staff, and the upgrading of existing and provision of new high-cost infrastructure to provide increased resilience. While infrastructure requirements and associated costs continue to rise, customers expect to receive more services at a reduced price.

This position is further complicated by changes in climate, population growth, the rapidly changing technological landscape, social norms and the continual push for utilities to encourage customers to be economical.

Customers expect organizations to take notice of, and act to address, their concerns and complaints. Failure to do so can result in escalation of complaints to the organization’s management and the media. Transfer of dissatisfied customers to competing utilities is often quick and easy, so utilities need to assess customer sensitivity, e.g. in terms of numbers of customer complaints about an issue, to develop reputational trigger points for action.

Utilities are moving into a new and more complex environment. For example, electricity generation is becoming more distributed, and through technology, is moving closer to the consumer. Smarter solutions are required to effectively manage network operations and the digital ecosystem.

For utilities to thrive, forecasting needs to identify disruptive technologies that have the potential to change investment pathways, reduce demand and alter the way services are provided.

This PAS is designed to lead utilities through the process of:

• developing and driving risk management capability;
• identifying threats, opportunities and related trends;
• assessing the requirements for a range of business continuity plans (BCPs);
• evolving the crisis/incident management capability to manage all potential disruptive events;
• building adaptive capacity, including an enterprise learning capability for resilience; and
• understanding risk, so that utilities can focus their limited resources on areas where enhanced resilience is most needed.

0.2 Navigating the challenges

Utilities need to find ways to navigate through the array of business, social and environmental challenges by understanding and managing risk and increasing resilience in the context of:

• achieving organizational objectives;
• meeting customer expectations;
• acting in accordance with key business values;
• assessing risk tolerance and appetite;
• meeting regulatory requirements;
• keeping up with technological advancement; and
• responding to unpredictable, disruptive and sometimes extreme events.

These challenges can exceed what can be achieved with available funding, therefore a range of factors are to be taken into account during decision making. These factors include cost if the risk impacts and cost of mitigating the risk, risk tolerance and potential reputational impact. In addition, some level of risk will be accepted where the cost of further risk reduction does not make economic sense.

Risk-based decision making and performance management are essential considerations for utilities as they make key strategic decisions on future business models, innovation, asset investment, revenue protection and diversification.

Figure 1 provides an illustration of cost versus risk decisions.

Figure 1 — Cost versus risk decisions

In changing times with increasing uncertainty and complexity, utilities need to develop the key areas of proactive risk management, risk-based decision making and processes to improve resilience. This enables them to build adaptive capacity to resist, respond to and recover from an increasing array of foreseeable and unexpected dynamic and disruptive challenges.

Resilience comprises a range of short-, medium- and long-term measures that help a utility build the adaptive capacity needed to withstand stresses and shocks. By developing ERRM capability, utilities can also identify opportunities where benefits (related to objectives) can be realized.

0.3 Enterprise risk and resilience management (ERRM)

Enterprise risk management (ERM) can be defined as the methods and processes used by utilities to manage risks, increase resilience and identify opportunities related to the achievement of their objectives.

ERRM builds on ERM and is designed to be an integrated and joined-up approach to managing risk and improving resilience across a utility and its extended networks. It provides a way to determine the level of organizational investment to be made to increase organizational resistance, as well as response and recovery capability.

ERRM can identify positive benefits related to achievement of objectives. ERRM can also:

• maximize organizational capability;
• identify potential opportunities and encourage innovation;
• improve situational awareness;
• inform risk management, including areas where more risk could be accepted;
• identify areas where business continuity and incident management plans are required;
• improve resilience, including response and recovery capability;
• aid decisions on capital investment to increase organizational resistance; and
• provide assurance that business plans are robust and satisfy regulatory scrutiny.

Effective risk and resilience practices take time to build and are driven by the leadership team which is responsible for making these practices part of the utility’s culture, championing change through personal demonstration of their commitment. It is a continuing journey as the social and technological environment changes.

This PAS is designed to provide a path to ordered development, improving risk, business continuity and the resilience of utilities over time.

Figure 2 provides an overview of the integrated ERRM model.

Figure 2 — Integrated enterprise risk and resilience management (ERRM) model

NOTE Copyright is claimed in this illustration. Reproduction of this illustration and making products from it might infringe that copyright. Copyright owner is Watercare Services Limited.

PAS 60518:2020

Developing and implementing enterprise risk and resilience management (ERRM) in utilities. Guide

Current

Published:

31 Jul 2020