winning strategies for mitigating risk...business development engineering bde) / engineering &...

Winning strategies for mitigating risk2017 Engineering and Construction Conference

Copyright © 2017 Deloitte Development LLC. All rights reserved. 2

Mark BlumkinManaging DirectorDeloitte Advisory [email protected]+1 212 436 2359

Michael A. HostettlerManaging DirectorDeloitte Advisory [email protected]+1 714 4367768

Mark BurroughsManaging DirectorDeloitte Advisory [email protected]+1 571 766 7062

Edward KoralSpecialist LeaderDeloitte Consulting [email protected]+1 212 618 4464

Presenting today

Jim MannelloPartnerDeloitte Tax [email protected]+1 203 708 4275

Matthew MurchSenior ManagerDeloitte Advisory [email protected]+1 312 486 2311

Financial & Project Risk Management


Risk intelligent enterprises adopt a balanced perspective of risk management, supported by fundamental principles:

Building the Risk Intelligent EnterpriseTM: Framework applied to Enterprise Risk Management

Nine Principles for Building aRisk Intelligent Enterprise

The Risk Intelligent Enterprise

Common Definition of Risk

Common Risk Framework

Roles & Responsibilities

Transparency for Governing Bodies

Common Risk Infrastructure

Executive Management Responsibility

Objective Assurance and Monitoring

Business Unit Responsibility

Support of Pervasive Functions


Project Risk Management Framework

Risk Oversight

Risk Governance

People

Systems / Tools Data Management Metrics & ReportingTools

Risk Initiation & Planning Risk Identification Risk Assessment

Objective Setting Policies Roles & Responsibilities Risk Taxonomy Risk Appetite /

Threshold

Cro

ss-T

eam

In

teg

rati

on

Project Risk Management Process and Procedures

Risk Monitoring & Control

Risk Response Planning

Risk Response Execution Close Risk

Risk Identification and Assessment

Risk Response and Control

Culture Knowledge, Skills & Behaviors


Effectiveness is understood by measuring specific influencers and indicators

Measuring and monitoring risk culture effectiveness

Example survey responses:• In this organization, we assess

and learn from risk events and mistakes when they occur

• I understand the keyrisks associated with myrole

• Our people are made aware of their risk-relatedresponsibilities from the daythey are hired

How the organizational environment is structured and what is valued

To fully understand an organization’s current risk culture effectiveness and to track progress of cultural change, a focused diagnostic is required. Deloitte has developed an approach to measuring risk culture effectiveness based on our Risk Culture Framework. The framework consists of 16risk culture indicators aligned to the four risk influencers. Once an organization’s risk culture is understood, then the Risk Culture Framework canbe used to begin to help to manage it, too.

How people in the organization interact with others

The reasons why people manage risk the way that they do

The collective risk management competence of the organization

Example survey responses:• The pressure on me to meet

performance targets is balanced with the need to comply with risk policies, processes and procedures

• People in this organization are penalized if they take unacceptable risks, even if their actions subsequently generate good returns

Example survey responses:• When it comes to risk

management, this organization practices what it preaches

• People in this organization know how to escalate risks

• People in this organization share similar ethical values

Example survey responses:• People in this organization are

expected to do what they are told, no matter what

• Risk management concerns are discussed openly and honestly in this organization

• The leaders of this organization role model the right risk behaviors

Risk Culture

Organization

Motivation

Risk Competence

Relationships

Risk Culture Framework


A Risk Taxonomy is a classification system to organize enterprise-wide risks and create a common risk language. The purpose of the taxonomy is to organize the universe of risks into logical groupings (risk areas and risk categories), which helps determine ownership and accountability for risk and facilitates identification of emerging risks.

Proposed Risk Taxonomy for our clients

Project RiskEnvironment,

Health & Safety

Information Technology

Human Resources

Regulatory & Compliance

Organization Structure & Leadership

Reputation

Operations

Site Execution

Procurement Risk

Technical / Design

Contractual

Quality Risk

Project Control

Interface with

Customers

Subcontract

JV

Interface with Other

Related Projects

Strategy & Planning Finance

Environmental Health &

Safety

Hazard Management

Business Continuity

Management

Technology

Physical Security

Information Security

Disaster Recovery

Plan

Architecture

Record Management

Change Management

Technology Licensing

Data Privacy & Protection

Knowledge Management

Performance Management

Payroll

Retirement Program

Talent Pipeline / Recruitment

Training & Development

Record Management

Communication

Retention

Culture

Regulatory

Laws & Regulations

Oversight & Supervision

Leadership

Governance

Transparency

Ethics

Investment / Project

Assessment & Evaluation

Reputation External Factors / Trends

Planning

Mergers / Acquisitions /

Diversities

Innovation

Extended Enterprise

Growth

Outsourcing

Competition

Accounting

Internal Controls

Insurance / Hedging

Liquidity

Taxation

Planning, Budgeting & Forecasting

Management Reporting

Assets & Infrastructure

Level I Risk Area

Level II Risk Category

Legend


The following are a few examples of tools that Deloitte has implemented for risk tracking and reporting:

Risk management tools

Risk Information Form

RISK IDENTIFICATION INITIAL RISK

Risk Assumptions

Risk Category Potential ImpactMost Likely

Cost ($ millions) $2.2

Schedule (days) 8Risk Name

Risk Symptoms

Initial Risk Level

RISK RESPONSE RESIDUAL RISK

Risk Root Cause(s)

Risk Response Maximum Potential ImpactResidual Risk Score (= Likelihood x Impact)

Response Name Residual Risk Level

Action Plan Details

Contingency allowance providedResidual cost ($M)Residual schedule impact (days)

Risk Accepted and Sign Off By

Develop enhaced training program for key trades requiring additional labor. Implement aggressive recruiting plan. See Training Strategy and Recruitment Plan for further details.

Of Concern

Lack of available skilled labor is resulting increased labor costs and may impact productivity.

Medium Residual Risk Assessment

Likelihood of Occurrence

6Of Concern

3

Minor

Moderate

Initial Risk Score (= Likelihood x Impact)

Improve training and recruiting.

Trades XZY have been impacted and trends indicate costs may increase by $2.2M. See

supporting Labor Availability Analysis for further details.

Moderate Moderate

9

Impact Score

Medium

Insignificant

Active

John Doe

EX001

Resources (Who is doing the work)

Likelihood of Occurrence

Maximum Potential Impact

Date of Identification

Skilled Trades Labor Availability Other (Quality, Customer Satisfaction, etc.)

Example ProjectResponsible Organization

$1.2

Lack of skilled labor in local areas and increased completition with other construction projects.

Mitigate

Risk Number

8-Sep-08Risk Initiator

Status

RISK REGISTERACME - Example Project Owner:

Date:

Risk No. Status Risk Date of Risk Risk Name Likelihood Max Impact Initial Risk Response Risk Response Action Action Response Residual Residual Residual Risk Risk

Initiator Identification Category Summary Description - Root Causes L:1-5 Cost Schedule Other I:1-5 Score Level (4 T's) Action Plan Owner Due Date Cost Likelihood Impact Score Level Signed Off Cost Schedule

EX001 Active John Doe 8-Sep-08Resources

(Who is doing the work)

Skilled Trades Labor Availability Medium 2.2 8 Insignificant Moderate 9 Of Concern Mitigate Improve training and recruiting. John Doe 20-Sep-08 $0 Medium Minor 6 Of Concern 0 1.2$ 3.0

EX002EX003EX004EX005EX006EX007EX008EX009EX010EX011EX012EX013EX014EX015EX016EX017EX018

Opportunity Status Initiator Date of Category Opportunity Name Likelihood Max Impact Initial Level Response Response Action Action Response Residual Residual Residual Level Signed Off

No. Identification Summary Description L:1-5 Cost Schedule Other I:1-5 Score (4 T's) Action Plan Owner Due Date Cost Likelihood Impact Score Cost Schedule

EX-OP001 Active John Doe 8-Sep-08 Interface with Procurement Accelerate RFP for Equipment High 0 10 Insignificant Moderate 12 High Enhance

Identify other procurement efficiencies

John Doe 15-Oct-08 $0 High Major 16 High 0 -$ 10.0

EX-OP001EX-OP001EX-OP001EX-OP001

Contingency

John Doe

8-Sep-08

Initial Impact Assessment Contingency Allowance

RESIDUAL RISK

INITIAL OPPORTUNITY OPPORTUNITY RESPONSE PLAN RESIDUAL OPPORTUNITY

RISK IDENTIFICATION INITIAL RISK RISK RESPONSE PLAN

Initial Impact AssessmentOPPORTUNITY IDENTIFICATION

Risk RegisterThe Risk Register is summary document typically in spreadsheet format used to identify, document and manage project risks. The Risk Register houses all identified risks until a Risk Response Plan has been implemented and the Residual Risk signed off by the Risk Owner. The Risk Register is used for both threats and opportunities.

Risk Management Process Flow Chart

The Risk Management Process Flow Chart describes the iterative risk management process tasks to be performed by the key risk management stakeholders including risk identification, risk assessment, risk response planning and control and monitoring.

Roles and Responsibilities MatrixThe Roles and Responsibilities Matrix is a table describing the roles and responsibilities for each position with regard to the key project risk management tasks. This matrix provides guidance regarding ownership for specific tasks, responsibilities for executing the work, and supporting roles.

Enbridge Proposed PMT Change Management Process – DRAFT FOR DISCUSSION

Valid for all Phases of the Proposed Major Capital Project Lifecycle

Proj

ect M

anag

er /

Lead

(Bus

ines

s D

evel

opm

ent E

ngin

eerin

g (B

DE)

/ En

gine

erin

g &

Proj

ect E

xecu

tion

(EPE

))

DRAFT

Orig

inat

or (I

dent

ifier

of

Cha

nge

or C

hang

e R

equi

rem

ent)

Proj

ect C

ost/

Sche

dule

Con

trol

Engi

neer

(PM

T)

Proj

ect M

anag

emen

t Tea

m (P

MT)

Pr

ojec

t Dire

ctor

Oth

er F

unct

iona

l G

roup

s an

d Ex

tern

al

Stak

ehol

ders

Potential Change Identified

Initial identification Root Cause,

Cost, Schedule and Scope impact of potential change

Informed of Potential Change

Originate Potential Change Notice

(PCN) Document and record

Potential Change in Project Change

Log

Review Potential

Change Notice & Project

Change Log

PMT Contingency Management

Process

Informed of Potential Change

Does urgency / Impact

warrant Exception Sub-process

Review Potential

Change with Functional

Groups

Review Potential Change identify

any related changes /impacts due to potential

change

Determine Total Impacts to

Scope, Cost, Schedule, Cost of Schedule &

Funding

Update PCN and Project Change Log

Review Potential Change Notice & Project Change

Log

Merit Assessment of Potential Change & Supporting Info.

Convert Updated PCN to a Project Change Order

Update PCN and Project Change Log End

Endorse Change

Finalize Change Order and

Update Project Change Log

Review Change Order and Project

Change Log Ensure Budget /Schedule / Scope and Contingency Log are updated

InformedChange

within PD Authorization Limits & Funding

Available

Review with Customer via BD

(If Required)

Endorse or Reject Change

No

NO MERIT

MERIT

YES

Seek AFE and/or Higher Approval Authority

NO

Review / ensure Functional Group and Stakeholder

contact and input. (As Required)

Informed

See PMT Exception

Sub-process

Approve Exception Sub-

process

Yes

Yes

Involved Functional Group and Stakeholder Endorsement –

Sign off on Change

Ensure Change implemented in accordance with

PCO

Implement Change

1

2

3

4

56

7

8

9

1011

12 13

14 15

16

17

18

19

End

6a

# Process defined

elsewhereProcessDocumentTerminator

Note NumberDecision

Process Flow Legend:

Insurance


Emerging issuesInsurance/Risk Management, Captives and OCIPs/CCIPs

Tax Reform Looming: Large self-insurance reserves with DTAs attached to them are prime territory for captive transactions, since the value of these DTAs could shrink significantly with the expected decline in federal corporate income tax rates.

Uptick in Insurance Rates (maybe): Following long-term decline in rates spanning over 15 years, most major lines, including commercial property and commercial auto, saw rate increases in May 2017. May also saw an increase in workers’ compensation costs for the first time in recent quarters.

Debate on Insurable Risk Rages On: Tax Court ruling in favor of taxpayer in R.V.I. Guaranty v. Commissioner expands the possibilities for defining and insuring the risks of your business.

Cyber Insurance becoming mainstream and expanding: Cyber insurance is expanding beyond personally identifiable and sensitive information, and new policies now include linked property/business interruption/cyber coverages.

Micro captives under the scope: Waiting for decision on Avrahami, and IRS Notice 2016-66, which makes 831(b) captives a “transaction of interest”

Proliferation of captive domiciles, and anxiety over self-procurement premium tax: They’re linked. It is resulting in a dilution of captive expertise among regulators, increased risk of poorly-designed or conceived programs, and potential damage to captives’ reputation as a legitimate risk management solution.

Cubs win the World Series: Proof that anything can happen. You’d better buy insurance, just in case. But can it happen again in our lifetimes?

Government contracting

Geographic expansion


International business risks

SBU Risk

Risk that one SBUs performance with a particular client may adversely affect the current or future business of another SBU.

Religious and Cultural

The risk that religious or cultural customs prevent labor from working the typical workweek. Also, in some countries, the summer vacation season causing a significant slowdown of activities at offices, supplier shops and sites.

Weather

Normal weather patterns in the area or available daylight, limit construction activities during certain times of the year be aware of local conditions.

Political & Socioeconomic

The risk of adverse consequences through political actions or socioeconomic conditions in a country or state in which Contractor has made significant investments, is dependent on a significant volume of business or has entered into an agreement with a client, JV partner, subcontractor or supplier.

For example: • possible nationalization, • security threats, • corruption, and expropriation of

assets without compensation,• currency blockage or • other restrictions.

Does your contract protect you? Do you have local legal counsel?

Crisis Events

Risk associated with events outside Contractor’s or the client’s control.

Examples: extreme weather (tornadoes, hurricanes, abnormal temperatures, unusual rainfall or snowfall), floods, earthquakes, fires, explosions, total power failure, major discharge of toxic substances, labor strikes and walkouts at the client’s facility or at suppliers, acts of war, terrorism, criminal acts, sabotage, and accidents.

Competition

Too many competitors in a particular geographic area, pursuing a particular prospect, or supporting a key client or industry are driving margins down. What does the industry look like from the local point of view.


International business risks

Outsourcing - Loss of Profits

Risk of not outsourcing non-core activities when financially advantageous to Contractor or when higher value can be obtained by involving outside consultants.Third Party Risk

Risk that outside service providers (Third Party Administrators, local or foreign partners, consultants or agents) will not act within their defined limits of authority and will not perform in a manner consistent with the values, strategies and objectives of the company.

Bonding & GuaranteesRisk that significant partners, subcontractors or suppliers are not sufficiently bonded to limit Contractor’s exposure.

Risk associated with allocating Contractor’s bonding, parent company guarantee or letter of credit capacity to a long term project which does not bring expected returns. What are the local market conditions for bonding, LOC, insurance products?

Reputation – Fraud, FCPA

The risk that Contractor may lose clients, key employees or its ability to compete, due to perceptions that it does not deal fairly with clients, suppliers and stakeholders, does not know how to manage its business, or does not perform on its projects (safety, cost, schedule, quality). This is a real world result of having an FCPA issue or other fraud “news”—bad news travels fast.

Disaster Recovery

The inability to sustain operations, provide essential products and services, or recover operating costs as a result of a major disaster (accident, sabotage, work stoppages, network downtime, loss of data). The inability to recover from such events could damage Contractor’s reputation, ability to obtain capital, or investor relationships. What are your evacuation plans to get your workforce home?

Outsourcing & Competition

Risk that strategic business processes outsourced will ultimately create competition for the outsourcing organization because the know-how shared with the consultant will be later exploited by the consultant or given to a competitor.


International business risks — Project site

Site Logistics

Noise, dust, night lighting, labor congestion, parking, or travel to site restrictions.

Permits & Utility Coordination

Access to rights-of-way, easements, utility connections and other site elements

Public InteractionTourist/local population interferences (attitude towards project, client or contractor) and local economic, social, political or labor posture conditions.

Capacity & Labor Pool

Population in the area is too small to either provide the necessary labor or to support the project with sufficient lodging, restaurants, police, fire, security, medical facilities, utilities, potable water, telephone, internet service, or infrastructure.

Site Conditions

Severe winters, difficult topography, restricted trafficabilityor drainage.

Location & Transportation

Access to ports, railroad, highways, altitude, remoteness or congestion, dimensional or weight restrictions on the transport of construction equipment or plant components.

Jeopardy


500 500 500

Geographic ExpansionInsurance and CaptivesFinancial and Project ManagementGovernment Contracting

400

300

200

100 100

200

300

400

100

200

300

400

100

200

300

400

500


Question:This the most important step when receiving a contract from the US Government.

Government Contracting100 Points


Answer:What is Read the Contract?



Question: The US Government customer who “has a warrant” to spend the government’s money.

Government Contracting 200 Points


Answer:Who is the Contracting Officer?



Question: The two most important steps to avoid at-risk efforts



Answer:What is Communicate with the Customer and Communicate Internally?



Question: The allowability of costs associated with preparing a Request for Equitable Adjustment (REA).



Answer:What is allowable?



Question: The allowability of costs associated with preparing a Claim.



Answer:What unallowable?



Question:The stage in the project life cycle at which risk management begins.

Financial and Project Management100 Points


Answer:What is the bidding stage? (Or What is the Go/No-Go Decision?)



Question:The technique which companies implement to identify and mitigate risks throughout the organization.



Answer:What is Enterprise Risk Management?



Question:A frequently used tool to actively monitor risks and risk response plans throughout the project life cycle.



Answer:What is a Risk Register?



Question:A statistical tool used to quantify the probability and impact of risks on achieving cost and schedule goals.



Answer:What is a Monte Carlo simulation?



Question:A list of examples include: • Misalignment of owner’s scope and budget expectations

• Limited or incomplete design• Poor performance by subcontractors• Political influence on project goals• Integrated schedule management across all stakeholders



Answer:What are common construction risks?



Question:Workers’ compensation, general liability, and sub-contractor default are three lines of coverage that are often “wrapped” into this insurance structure.

Insurance and Captives100 Points


Answer:What is a Contractor-Controlled Insurance Program (CCIP)?



Question:DTA is the acronym for this item on your balance sheet that will shrink if corporate income tax rates decline.



Answer:What is a deferred tax asset?



Question:If your screens go dark, you’d better hope you have this emerging insurance coverage.



Answer:What is cyber-insurance?



Question:This type of insurer is designed more to meet the risk management needs of its non-insurance parent, rather than its own profitability.



Answer:What is a captive insurer?



Question:This is the key ingredient of a loss event that the IRS thinks is necessary for a risk to be considered an insurable risk.



Answer:What is fortuity?



Question:This Act causes US companies doing business overseas to reconsider the “practices” of their trusted business partners and subcontractors

Geographic Expansion100 Points


Answer:What is Foreign Corrupt Practices Act?



Question:US companies may consider little value is gained from this but it’s a significant revenue generator for most foreign nations and is often manipulated by wrong doers.



Answer:What is a Value Added Tax or VAT



Question:Over $2.7 billion US is paid daily around the world for this?



Answer:What is the daily cost of bribes around the globe According to the World Bank



Question:This job that isn’t about rainful but it’s what you call a good job to collect bribes?



Answer:What is a “Wet” government job?



Question:Loan Assembler, Procurement Advisor, Soil Expeditor, Solar Accessibility Engineer, Ice Diver



Answer:What are factious job titles used to commit fraud—yeah they actually billed for an Ice Diver on a project in Malaysia


About DeloitteDeloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee (“DTTL”), its network of member firms, and their related entities. DTTL and each of its member firms are legally separate and independent entities. DTTL (also referred to as “Deloitte Global”) does not provide services to clients. In the United States, Deloitte refers to one or more of the US member firms of DTTL, their related entities that operate using the “Deloitte” name in the United States and their respective affiliates. Certain services may not be available to attest clients under the rules and regulations of public accounting. Please see www.deloitte.com/about to learn more about our global network of member firms.

Copyright © 2017 Deloitte Development LLC. All rights reserved.36 USC 220506

http://www.deloitte.com/about

winning strategies for mitigating risk...business development engineering bde) / engineering &...

Documents