WhitepaperIOverallPerspectivefinal-2007-030-0137-2-

download WhitepaperIOverallPerspectivefinal-2007-030-0137-2-

of 16

Transcript of WhitepaperIOverallPerspectivefinal-2007-030-0137-2-

  • 8/6/2019 WhitepaperIOverallPerspectivefinal-2007-030-0137-2-

    1/16

    ...................................................................................................

    Risk Management in the ElectricityIndustry

    White Paper I Overall Perspective...................................................................................................

    Group on Risk Management...................................................................................................

    January 2007Ref. : 2007-030-0137

  • 8/6/2019 WhitepaperIOverallPerspectivefinal-2007-030-0137-2-

    2/16

    The Union of the Electricity Industry EURELECTRIC is the sectorassociation representing the common interests of the electricity industryat pan-European level, plus its affiliates and associates on several othercontinents.

    In line with its mission, EURELECTRIC seeks to contribute to the

    competitiveness of the electricity industry, to provide effectiverepresentation for the industry in public affairs, and to promote the role ofelectricity both in the advancement of society and in helping providesolutions to the challenges of sustainable development.

    EURELECTRICs formal opinions, policy positions, and reports areformulated in Working Groups, composed of experts from the electricityindustry, supervised by five Committees. This structure of expertiseensures that EURELECTRICs published documents are based on high-quality input with up-to-date information.

    For further information on EURELECTRIC activities, visit our websitewhich provides general information on the association and on policyissues relevant to the electricity industry; the latest news of our activities;EURELECTRIC positions and statements; a publications cataloguelisting EURELECTRIC reports; and information on our events andconferences.

    EURELECTRIC pursues in all its activities theapplication of the following sustainable developmentvalues:

    Economic DevelopmentGrowth, added-value, efficiency

    Environmental LeadershipCommitment, innovation, proactiveness

    Social ResponsibilityTransparency, ethics, accountability

  • 8/6/2019 WhitepaperIOverallPerspectivefinal-2007-030-0137-2-

    3/16

    Risk Management in the Electricity Industry............................................................................................

    Group on Risk Management............................................................................................

    Paper prepared by:Working Group on Risk Management:

    Sponsored by:

    ATEL, Aare Tessin Ltd (Switzerland)CN Transelectrica SA (Romania)EDF, Electricit de FranceEDISON S.p.A. (Italy)EDP, Energias de PortugalElectrabel (Belgium)ENDESA, S.A. (Spain)Enel S.p.A. (Italy)Enel Viesgo Energa (Spain)EVN AG (Austria)Fortum (Sweden)IBERDROLA, S.A. (Spain)MVM, Magyar Villamos Mvek RT. (Hungary)

    REE, Red Elctrica de Espaa (Spain)RWE AG (Germany)UNION FENOSA (Spain)Union of Employers of Power Industry in Slovakia, ENERGETIKY SLOVENSKAVattenfall AB (Sweden)Verbund, sterreichische Elektrizittswirtschafts-AG (Austria)

    With the collaboration of:

    MOLINER DE PALACIO Agustin (ES), Coordinator; AGH Peter (SK); ALLEN LIMAJos (PT); ARN Fredrik (SE); BEROUX Pierre (FR); BOUCHER Jacqueline (BE);BNTING Hans F. (DE); FALVELLA Maria Anna (IT); HAGLAND Erik (SE); HAUER

    Harald (AT); HOLLENSTEIN Walter (CH); IBARRONDO Iigo (ES); LAENGLEMichael (AT); LAVICH Gabor (HU); PRIETO MONTERRUBIO Eloy (ES); SANCHEZGOMEZ Manuel (ES); VORONCA Simona Louise (RO); D'ECCLESIIS Vittorio (IT);DEUTSCH Emmanuel (FR); MICHIELS Alain (BE); POLZER Thomas (AT)EURELECTRIC: Gunnar LORENZ

    in cooperation with McKinsey & Company.

    This paper has been adopted by the group in December 2006.

    Copyright 2007 Union of the Electricity Industry EURELECTRIC A.I.S.B.L.

    All rights reservedPrinted in Brussels (Belgium)

  • 8/6/2019 WhitepaperIOverallPerspectivefinal-2007-030-0137-2-

    4/16

    TABLE OF CONTENTS

    EXECUTIVE SUMMARY .............................................................................................5

    1. INTRODUCTION......................................................................................................7

    2. THE NEED FOR ENTERPRISE RISK MANAGEMENT..........................................7

    2.1.A RISKIER ENVIRONMENT......................................................................................82.2.HIGHER RISK MANAGEMENT REQUIREMENTS .........................................................9

    3. A DEFINITION OF ENTERPRISE RISK MANAGEMENT ......................................9

    3.1.RISK MANAGEMENT PROCESSES.........................................................................103.2.ORGANISATIONAL STRUCTURE ...........................................................................113.3.TOOLS, METHODOLOGIES, AND SYSTEMS ............................................................123.4.SKILL REQUIREMENTS ........................................................................................13

    4. GUIDELINES FOR ERM IMPLEMENTATION ......................................................13

    4.1.INCREMENTAL AND ITERATIVE IMPLEMENTATION ..................................................134.2.INTEGRATED APPROACH.....................................................................................144.3.FOCUS ON VALUE CREATION...............................................................................15

  • 8/6/2019 WhitepaperIOverallPerspectivefinal-2007-030-0137-2-

    5/16

    2007-030-0137 January 20075

    Executive Summary

    This document is part of a series of five articles on enterprise risk management(ERM) published by EURELECTRIC with the cooperation of McKinsey & Company.

    The purpose of the series is to define good practices in ERM as a basis of referencewithin the European electricity sector. The articles are designed to serve the needs ofcompanies at various stages of implementing enterprise risk management, forexample as a high-level implementation guide or as a checklist of good practices.This article presents an overall perspective on enterprise risk management adaptedto the specific needs of the industry. The other four articles focus on four specifictopics: (i) risk identification and prioritisation, (ii) risk strategy, (iii) governance andcontrol, and (iv) change management.

    The need for ERM in the European electricity sector has two main origins. First,players in the electricity industry are exposed to more risks today than has been thecase historically. Exposures to market and regulatory risks, in particular, haveincreased significantly and these risks can have a major impact on profit margins,company reputation, and the ability to fulfil social obligations. Second, players arefacing increasing demands from stakeholders concerned with risk management. Inparticular, regulation for listed companies has become more demanding in terms ofrisk transparency and control.

    Enterprise risk management consists of a set of organisational components thattogether aim to raise the level of risk management effectiveness across theorganisation. These organisational components cover:

    Risk management processes including (i) risk identification andprioritisation, (ii) risk strategy, and (iii) governance and control.

    Elements of organisational structure including (i) risk committees, (ii)corporate risk management, and (iii) the definition and allocation of riskownership.

    Tools, methodologies, and systems including (i) risk categorisation tools,(ii) risk scoring tools, (iii) methodologies to define risk strategies, (iv) riskmeasurement and reporting tools, and (v) supporting IT systems.

    Skills the capabilities required of (i) risk professionals and (ii) linemanagers.

    Implementation of these ERM components can be made easier by following three

    implementation principles:

    Incremental iteration. The three processes of ERM (risk prioritisation, riskstrategy, risk execution / governance and control) reinforce one another. It ismore effective to set up a full ERM process in the first year and incrementallyimprove over time, than to start with one of the steps and neglect the othersin the first year.

    Integration. The same overall approach should be deployed across allbusiness units, markets, assets, and geographies with the same level ofrigour, discipline, and effort invested in proportion to the importance of therisks. Not only does integration allow risk management to be more effective(e.g., only net positions are hedged), it is also a catalyst of businessintegration in a fast-consolidating industry.

  • 8/6/2019 WhitepaperIOverallPerspectivefinal-2007-030-0137-2-

    6/16

    2007-030-0137 January 20076

    Value creation. By equipping a company to apply effective tools andmethodologies to quantify risks and define effective risk strategies, ERMcontributes to the bottom line by improving risk/return ratios. The focus onvalue creation also contributes to change in mindsets, by making systematicuse of risk/return analysis across the company, from the boardroom to day-

    to-day operations in plants, in trading rooms, and in sales and networkmanagement.

  • 8/6/2019 WhitepaperIOverallPerspectivefinal-2007-030-0137-2-

    7/16

    2007-030-0137 January 20077

    1. Introduction

    Before deregulation, risk strategy for utilities was simple. As one CFO for a largeEuropean utility put it, It was all settled in the yearly meeting with the Ministry of

    Finance. Tariffs were adjusted to cover all risks and provide a target return oninvested capital deemed appropriate for a state-owned company.

    Times have changed. Markets deregulated. No longer protected, utilities are facing anunprecedented level of uncertainty in commodity prices, asset values, andparadoxically, the regulatory environment.

    Managing these risks effectively is not only a fiduciary duty of executives and boards,it has also become key to value creation. And risk strategy is what drives effectiverisk management.

    True to our objective of defining a basis of reference for good practices in the

    European electricity sector, we describe in the rest of this document the overallperspective of leading industry practitioners on Enterprise Risk Management (ERM) inthe European electricity sector. In particular, we will focus on three main questions:

    What creates the need for enterprise risk management?

    What are the key constituents of enterprise risk management?

    What are the main guidelines for implementation?

    For the Chief Risk Officer, answers to the first question will help generate buy-in forhis or her initiatives. Answering the second question will help define theorganisational blueprint for ERM. Addressing the third question will provide

    guidelines on how to lead implementation. In a companion paper, we address inmore detail the change management challenges CROs are facing whenimplementing ERM and what can be done to meet these challenges.

    2. The Need for Enterprise Risk Management

    The need for ERM in the European electricity sector has two main origins.

    A riskier environment - Companies in the electricity industry are exposed to

    more risks today than has been the case historically. Exposures to marketand regulatory risks, in particular, have increased significantly and these riskscan have a major impact on profit margins. In many European countries,deregulation forced a split of ownership between regulated and non-regulated activities, leaving part of the business (generation, wholesale,retail) without the cushion of stable, regulated cash flows.

    Higher risk management requirements - Companies also face increasingdemands from stakeholders concerned with risk management. Regulation forlisted companies has become more demanding in terms of risk transparencyand control and, compared with ten years ago, more players in the sector arenow listed companies.

  • 8/6/2019 WhitepaperIOverallPerspectivefinal-2007-030-0137-2-

    8/16

    2007-030-0137 January 20078

    2.1. A riskier environmentCompanies in the electricity sector are exposed to four main types of risk:

    Market risk Risk of financial gain or loss due to exposure to fluctuations inmarket prices. The four standard market risks are: interest rate risk, or therisk that interest rates will change; currency risk, or the risk that foreignexchange rates will change; equity indexrisk, or the risk that stocks or otherindex prices will change; and commodity risk, or the risk that commodityprices (e.g., energy, emission rights, bio-fuels, metals) will change.

    Credit risk Risk of loss due to a counterparty defaulting on a contract or,more generally, risk due to uncertainty about a counterparty's ability orwillingness to meet its obligations (contractual disputes and arbitration due tooperational issues are usually covered in operational risk).

    Operational risk Actual or potential losses resulting from events caused byinadequate or failed processes, people, equipment or systems, or fromexternal events.

    Business risk Risk inherent to the specific industry (e.g., uncertainty indemand, emergence of new technologies or know-how,), including strategicand regulatory risk (i.e., uncertainty due to legal actions or uncertainty aboutthe applicability or interpretation of contracts, laws or regulations).

    Over the past 5 to 10 years, the magnitude of each of these risks has increasedsignificantly for a variety of largely independent reasons:

    Market risks Deregulation introduced a market risk for electricity andnatural gas and both are notoriously volatile due to the limitations in storageand the low elasticity of short-term demand. New regulation has added amarket risk for CO2 emissions. Since this market started trading in March

    2005, it has had a major impact on power prices and has also displayed highvolatility. Coal has developed a liquid spot and forward wholesale marketsince 2001 and has also displayed high volatility because of high demand inChina and volatility in dry bulk freight prices.

    Credit risks The issue of credit risk emerged in Europe after the collapseof several US-based utilities in 2001-2003 (the most notable of which beingEnron), leaving their counterparties with open market risk positions. This typeof problem did not occur ten years ago, when most counterparties werestate-owned European utilities with limited exposure abroad.

    Operational risks One of the most striking changes in operational risks in

    recent years has been the emergence of extreme weather events. InDecember 1999, a major storm in France cut off the distribution grid to over200,000 customers. In January 2005, the "Gudrun" storm destroyed 30,000kms of transmission lines and cut off 730,000 customers in southernSweden. The heat wave of 2003 created an unprecedented situation wherenuclear plants could not run at full capacity because river water temperatureexceeded the maximum levels accepted by the environmental agency. Theageing fleet of European power generators is also likely to bring its share ofnew operational problems.

    Business risks Deregulation brought competition with new risks forincumbents such as potential loss of market share to new entrants anduncertainty about retail prices. Deregulation also brought more regulation on how competition should be played, how distribution companies should beunbundled, and which acquisitions can be authorised. More regulation is

  • 8/6/2019 WhitepaperIOverallPerspectivefinal-2007-030-0137-2-

    9/16

    2007-030-0137 January 20079

    expected to control polluting emissions (e.g., SOx, NOx) and wateremissions, and to control trading activities for third parties (e.g., MiFiD).

    Moreover, as more and more utilities are becoming listed enterprises, a largerproportion now faces an increasingly risky environment on their own, with graduallyless protection provided by their national governments. Governments that used toadjust tariffs to match acceptable returns are now doing the opposite effectivelyincreasing the risk profile of utilities. In some countries, ownership unbundling isforced upon utilities, isolating part of the business (generation, wholesale, retail)without the cushion of stable, regulated cash flows from transmission anddistribution. Other countries have put caps on wholesale or retail prices to limit priceincreases to consumers increasing the risk exposure of the utility.

    All these changes have created a riskier environment, making risk management amajor concern and creating a new and important managerial discipline for electricalutilities.

    2.2. Higher risk management requirementsOver the past decade, concern has grown about the quality of governance, riskmanagement, and control of listed companies and has been reflected in significantnew regulation and higher risk management requirements.

    Corporate scandals in the late 1990s and early 2000s reinforced this trend. Newregulation was introduced in some countries, most notably the Sarbanes-Oxley Act inthe United States (2003). Professional associations defined and made publicrecommendations for effective risk management, e.g., the COSO Enterprise RiskManagement Integrated Framework (2004) and, more specific to the electrical utilitysector, the CCRO Recommendations (2003).

    Formally, utilities are responsible for determining which regulations they need tocomply with and ensuring that they implement the processes and structures requiredto ensure compliance. A European utility not active or listed in the United States maynot need to comply with the Sarbanes-Oxley Act.

    However, European utilities cannot ignore the trend toward more regulation on riskmanagement and need to anticipate what will eventually be required of them. CEOsof leading corporations are well aware of this trend and it is another reason whyrisk management is becoming a top-priority agenda item.

    3. A Definition of Enterprise Risk Management

    Enterprise risk management is a set of processes and supporting organisationalelements that aim to: 1) identify a company's risks and prioritising them for externaldisclosure and management action, 2) define risk strategies for mitigating higher-priority risks, and 3) set up governance and control mechanisms to ensure properexecution of the risk strategies. These processes are performed under the leadershipand responsibility of the Board of Directors and the management team. Theirpurpose is not only to identify and avoid downsides but also to leverage risk

    management capabilities to optimise the risk/return profile of the company.

  • 8/6/2019 WhitepaperIOverallPerspectivefinal-2007-030-0137-2-

    10/16

    2007-030-0137 January 200710

    More specifically, enterprise risk management consists of:

    Risk management processes including (i) risk identification andprioritisation, (ii) risk strategy, and (iii) risk execution and control.

    Elements of organisational structure including (i) risk committees, (ii)roles and responsibilities of corporate risk management, and (iii) definitionand allocation of risk ownership to existing operational and functional entities.

    Tools, methodologies, and systems including (i) risk categorisation tools,(ii) risk scoring tools, (iii) methodologies to define risk strategies, (iv) riskmeasurement and reporting tools, and (v) supporting IT systems.

    Skill requirements including (i) qualification levels in the risk managementfunction and (ii) qualification levels in other operational and functional units.

    The rest of this section provides more detail on each of these elements.

    3.1. Risk management processesEnterprise risk management comprises three main processes, outlined here in termsof good practices worthy of emulation.

    Risk identification and prioritisation This process serves to classify therisks the company faces. In particular, management must determine whatshould be reported to investors, where management should focus itsattention, and which risks need to be addressed with an explicit risk strategy.The process runs through all the operational and functional units of thecompany with a common and company-specific universe of risks (the riskmodel) and a common and calibrated scoring methodology to isolate the

    most important risks.

    Risk strategy This process consists of determining which risks thecompany is competitively advantaged to keep, how these risks should bemanaged internally (in terms of risk prevention and risk mitigation), and howthe other risks should be transferred to third parties. The process runsthrough all the priority risks of the company, in coordination with strategicplanning. Risk strategy is also coordinated with the treasury to ensure thatthe company's resulting risk profile is compatible with the company's risk-bearing capacity as measured by its amount of equity.

    Risk governance and control This process consists of the monitoring andcontrol of the execution of risk strategies, using sound governance principlesas outlined in the risk policies of the company.

    These three processes are described in more detail in the companion papers: RiskIdentification and Prioritisation, Risk Strategy, and Risk Governance and Control.

  • 8/6/2019 WhitepaperIOverallPerspectivefinal-2007-030-0137-2-

    11/16

    2007-030-0137 January 200711

    The three processes of Enterprise Risk Management

    Risk identification and

    prioritisation

    Risk identification and

    prioritisationRisk strategyRisk strategy

    Governance and

    control

    Governance and

    control

    Define a risk model Run a process across

    all BUs to screen the

    risks the company is

    facing

    Use a consistentframework to assess

    each risk according to

    Global impact

    Probability of

    occurrence

    Level of control

    Iterate the assessmentwith BUs (CRM role)

    Select the priority risks To report to investors

    To focus management

    attention

    For each of the priorityrisks

    Identify the key risk

    avoidance / risk

    mitigation measures

    that could be

    implemented

    Determine the risk /

    return profile sought

    after by shareholders /

    management

    Assess whether the

    company is the naturalowner of the risk

    Decide which risk

    strategy to follow

    Outline an action plan

    Define and implementthe risk policies

    Define the risk reportingprocess for each

    external and internal

    stakeholder

    Set up the financialsteering and execution

    control processes

    3.2. Organisational structureEnterprise risk management relies on several elements of corporate structure:

    Risk committees The most important of these committees are the board-

    level Risk and Audit Committee, which defines and validates corporate riskmanagement policies, and the Corporate Risk Committee, comprising seniorcorporate executives whose role is to validate key risk-related decisions,such as large investments or market risk hedging strategies. The role ofthese committees is described in more detail in the companion paper RiskExecution and Control.

    Corporate risk management The corporate risk management team, ledby the Chief Risk Officer (CRO), is a key component of ERM. The CRO mayhave such an explicit title or may be the highest-ranking officer in charge ofrisk management. The corporate risk management team is the chief architectof the ERM program, responsible for designing and implementing it. It is also

    the owner of the risk management processes (risk identification andprioritisation, risk strategy, and risk execution and control). The risk team isalso in charge of proposing the designation of risk owners for specificbusiness areas or categories of risks to senior management.

    Risk owners A risk owner is responsible for identifying risks in adesignated business area (e.g., a plant) and for defining a risk strategy tomanage these specific risks. A risk owner is usually a company executive,but can also be a committee (e.g., for corporate hedging strategy). A riskowner can choose to delegate the execution of the risk strategy to anotherindividual or entity (e.g., the execution of the corporate hedging strategy maybe delegated to trading).

  • 8/6/2019 WhitepaperIOverallPerspectivefinal-2007-030-0137-2-

    12/16

    2007-030-0137 January 200712

    In addition, some business units may develop their own risk management team tohandle specific needs (e.g., wholesale-related risks in trading, customer credit risk inretail). When such units exist, the corporate risk management team usually leveragestheir skills and tools to perform some risk management tasks (e.g., risk measurementand reporting). For governance reasons, these teams typically report hierarchically toa corporate function, even if they are located within the business unit they serve on adaily basis.

    3.3. Tools, methodologies, and systemsEnterprise risk management requires the development of sophisticated tools,methodologies, and systems. The most important ones are:

    Risk categorisation tools During the risk identification and prioritisationprocess, all the operational and functional units of the company arerequested to identify risks in their activities.For large utilities, the output ofthis phase could easily yield several hundred different types of risks. Tohandle the complexity inherent in such a large number of risks, it is useful to

    introduce risk categorisation tools that describe 20 to 30 categories of riskstailored to the specific types of risk the company faces (e.g., due to itsactivities, types of assets, or countries of operation).

    Risk-scoring tools After risks have been identified and categorised, thecompany needs to assess their relative importance. For utilities that usuallydeal with several hundred types of risk, it would be a daunting task toquantify each of them precisely. What is needed at this stage is a simple yetcalibrated scoring tool that allows management to decide where to focusattention. In general, a handful of risks emerge as having an order-of-magnitude more importance than the others.

    Methodologies for defining a risk strategy Risk strategies for individual

    risks are developed by their risk owners. Risk owners need methodologies todefine risk strategies that would allow the corporate functions to aggregatethe individual risk strategies into an overall risk strategy for the company,check for capital adequacy, and perform risk/return tradeoffs across thecompany.

    Risk measurement and reporting tools In the execution phase of the riskstrategy, management needs to check whether the expected risk/returnprofile has been achieved for individual risks and for the corporation as thewhole. Specific measurement and reporting tools need to be put in place tomeasure the quality of execution and to check compliance with corporateguidelines (e.g., capital at risk consumption, technical risk limits).

    Supporting IT systems Enterprise risk management requires IT systemsupport to obtain access to basic information (e.g., data series on pastevents for operational risks, market and credit risk exposures from tradingbooks and retail activities, business cases and strategic analyses forbusiness risks) and to perform sophisticated analytics for risk measurement(e.g., modelling of electricity prices, assessing economic capitalconsumption).

    Risk categorisation and scoring tools are illustrated in the companion paper: RiskIdentification and Prioritisation. Methodologies for defining risk strategies arediscussed in more detail in the Risk Strategy companion paper. Risk measurement

    and reporting tools are discussed in the Governance and Control companion paper.IT systems for risk management are beyond the scope of this series of documents.

  • 8/6/2019 WhitepaperIOverallPerspectivefinal-2007-030-0137-2-

    13/16

    2007-030-0137 January 200713

    3.4. Skill requirementsEnterprise risk management relies on a new managerial discipline riskmanagement. To reach risk management proficiency requires new skills not only

    knowledge of tools and methodologies but also the ability to incorporate a riskmanagement perspective and mindset in decision-making.

    As a consequence, when implementing enterprise risk management, a companyshould specify minimum risk management skill levels for the different relevant roles.In particular, skill levels should be specified for:

    Risk professionals (black belts) These people are fully dedicated torisk management in corporate or BU functions. Their roles includecontinuously improving tools and methodologies and coaching otherpersonnel on risk management.

    Trained managers (green belts) Operational and functional managersneed basic skills in applying risk management tools and methodologies. Theyalso provide on-the-job training on risk management to their teams.

    The companion paper on Change Management describes in more detail how todevelop the required risk management skills.

    4. Guidelines for ERM Implementation

    ERM implementation can be facilitated by following three overarching implementationprinciples:

    Incremental and iterative implementationAs ERM takes several years toimplement, each year should build on the previous one to avoid waste. Itmight be tempting to start the first year with risk identification andprioritisation alone. However, experience shows that it is more effective todevelop an initial version of all three processes in the first year and theniterate and improve on the implementation over the following years.

    Integrated approach ERM should be deployed in an integrated fashionacross the company. This allows: (i) clear company-wide prioritisation of risksfor managerial action and reporting, (ii) more effective risk managementthrough aggregation of related risks, and (iii) tighter and more rapid businessintegration in the context of mergers and acquisitions.

    Focus on value creation Electricity utilities in Europe need ERM to facethe mounting challenges of today's riskier environment and not just forcompliance reasons. ERM in our sector should focus on capabilities tooptimise risk/return ratios. The potential for value creation is substantial andwill help convince managers and executives across the company to play aleadership role in making it happen.

    The companion paper on Change Management describes in more detail thechallenges and key success factors of ERM implementation.

  • 8/6/2019 WhitepaperIOverallPerspectivefinal-2007-030-0137-2-

    14/16

    2007-030-0137 January 200714

    4.1. Incremental and iterative implementationA full ERM implementation is a multi-year effort requiring further refinements for manyyears to come. As ERM cannot be implemented in one go, it is important to carefully

    design an incremental implementation plan that builds on the efforts of the previousyears and manages expectations of the rest of the organisation.

    There are two main options to structure an implementation plan:

    Process by process setting up ERM one process at a time (e.g.,implement the identification and prioritisation process the first year, the riskstrategy process the second year, and the execution and control processthe third year).

    Iterative deploying all three ERM processes in the first year in a draftfashion and gradually improving them over time from accumulatedexperience and by adding new capabilities.

    Both approaches have been used in the industry. The process-by-process approachis simpler to implement, but takes more time to provide an integrated perspective. Theiterative approach can be immediately focused on the most important risks and can,therefore, lead to tangible results much more rapidly, but requires more businessjudgement and decision-making capability. On balance, we recommend the iterativeapproach.

    4.2. Integrated approachOne of the key contributions of ERM is to provide a company's board and

    management team with an integrated perspective on risk.

    To achieve that goal, ERM should be deployed across all business units, markets,assets, and geographies with the same methodology, even if some operational orfunctional units claim that they need to make exceptions. Differences should not beignored they should be integrated in the overall approach and if the integration istoo complex to realise on the spot, integrated during the next iteration.

    Integration brings multiple benefits:

    More effective prioritisation An integrated approach develops acorporate-wide perspective on risk and on the relative importance of risks.

    Management attention can be focused on those risks that are truly importantfor the company.

    More effective risk management As positions are consolidated (andnetted) across BUs, and correlations taken into account, they can beassessed accurately at the corporate level and dealt with more effectively.Many hedging strategies fail because they hedge a partial risk exposure, nota corporate risk exposure (e.g., price pass-through mechanisms are ignored).

    Tighter business integration Integrated risk management processes arean effective way to integrate new business units (e.g., after an M&Atransaction) and align corporate cultures.

  • 8/6/2019 WhitepaperIOverallPerspectivefinal-2007-030-0137-2-

    15/16

    2007-030-0137 January 200715

    4.3. Focus on value creationERM is often implemented for compliance reasons. For electrical utilities in Europe,compliance is an important consideration, but second in importance to the necessityof managing the unprecedented increase of risks in the sector.

    As a consequence, ERM should be focused on developing organisational capabilitiesto manage risks more effectively, resulting in improved risk/return ratios andadditional risk-adjusted value for shareholders.

    Focusing on value creation has an additional benefit: it makes ERM a much moreattractive value proposition to operational and functional managers and executivesacross the company, from the boardroom to operations in plants, in trading rooms,and in sales and network management.

  • 8/6/2019 WhitepaperIOverallPerspectivefinal-2007-030-0137-2-

    16/16

    2007-030-0137 January 200716

    Union of the Electricity Industry - EURELECTRIC - A.I.S.B.L.Boulevard de lImpratrice, 66 - bte2 - B - 1000 BRUXELLES

    Tel. : + 32 2 515 10 00 - Fax : + 32 2 515 10 10

    www.eurelectric.orgTVA : BE 0462 679 112