About the author:
Bill Raab is the director of risk control for Glatfelter Public Practice. Raab can be reached
at [email protected].
Water and wastewater services create a diverse set of operational risks that require management. Enterprise risk management (ERM) is an effective method to manage those risks because it is a holistic method that focuses on managing uncertainty so organizations can achieve their objectives. Some board members view risk management as only risk transfer and loss prevention, but there is more to consider.
The purpose of the ERM process is to identify key risks, determine their current condition and enact changes that reduce their likelihood or impact. This process, when used effectively by water utilities, increases their resilience to risk.
ERM Process. An effective ERM program requires the management team to commit to the process. The first step in the ERM process is to build the governance structure for the program, including senior-level management oversight and control.
Defining roles, responsibilities, scope and context provides an organization with a solid foundation for the program. Risk assessment is the next part of the ERM process, which includes identifying, analyzing and evaluating the risks. This determines the entity’s current state of resiliency to risk.
Risk Identification. According to the U.S. EPA, there are roughly 240,000 water main breaks per year and water main leaks discharge trillions of gallons of treated water annually. The lost revenue, increased working hours and damage to property all create risk to water utilities. An effective ERM process should identify the water loss risk, and assess whether the mitigation techniques enacted by the utility are effective.
Some organizations use tools such as surveys, interviews and external consultants to obtain feedback about the risks they face. The preferred method is to have a roundtable with a diverse group of employees facilitated by a subject matter expert. Diversity is important at these roundtable discussions to eliminate group-think bias. Allowing individuals the safety to speak freely also is important.
Risk Analysis. The risk analysis step allows the utility to determine the likelihood and severity of those identified risks. Assumptions can reduce the effectiveness of this step as it is human nature to think that the utility is not vulnerable to the risk. Incorporate industry data and work with industry consultants during this step to avoid the effect of presumption on risk analysis.
Risk Evaluation. The final step of the risk assessment process is to evaluate the risk. After the risks are evaluated, they should be ranked so resource allocation can be considered during the next step of the ERM process.
Risk Treatment. Risk treatment is the process of enacting changes in the utility’s operations to reduce the likelihood or severity of loss resulting from an identified risk. Techniques to treat risk can be categorized as risk control or risk financing.
Risk Control Examples. Risk control considerations include finding ways to avoid the risk, such as removing the risk from the operation or substituting a less hazardous process. An example is replacing chlorine gas as a treating agent with a less hazardous option. Another option is duplicating and separating items that are essential to the operation. Many firms duplicate items essential to the operation, and some even store them in separate locations. Lastly, diversification is another technique that organizations use to combat risk. Companies cross-train employees so they do not have an ability gap if someone cannot show up for work.
Risk Financing. Risk financing is traditionally accomplished through the purchase of insurance. For instance, a water utility purchases insurance to pay for the loss of a property, liability claims and workplace injuries. However, other risk financing techniques are available to organizations, including contractual risk transfer, risk retention and purchasing financial vehicles, such as oil futures. If insurance is selected as a risk financing technique, consider that not all losses are covered by insurance and sometimes consequential losses are greater than the covered loss, so risk control is still necessary. Lost revenue from a water main break may not be covered by the policy, but the damage to a property may be.
Review. The final step in the ERM process is to monitor and review efforts to accomplish continuous improvement. The process must change with the times and new risk treatments should be introduced into the process, which changes the risk analysis and risk evaluation. An ERM program is not an effortless endeavor. However, the implementation of this process allows a utility to effectively allocate financial resources in a manner that efficiently creates resilience to overall risk and provides a solid return on their investment.