1.0 Introduction

Risk is defined as an uncertain event or condition that has a probability of transpiring in

which there will be a positive or negative impact to a situation, project or process. A

certain risk has one or more causes and when it happens, there will be also one or more

impacts. If also these will occurs, there may be impacts with the schedule, cost or

performance. All projects or operations assume risks and by means of Risk

Management, tools and techniques are used to monitor and control these events that will

have some kind of impact to the outcome of a project or production (Gray & Larson,

2006).

Risk Management is a practical method of defining and resolving the workplace health

and safety issues and problems. It is an ongoing process of identifying and managing

risks in order to avoid the exposure. This method includes the several processes that

consists Risk Management Planning, Risk Identification, Risk Analysis, Risk Monitoring

and Risk Control. The objective of Risk Management is to reduce the probability and

impact of risk that is adverse to the project or production. However, if the impact is

positive the probability of the risk should be increased (Heally, 1997).

Risk Management Plan will provide the guidelines and a framework that is based on

industry acceptable practices. The purpose of the plan is to establish the methodology

for identifying, mitigating and avoidance of risk. Risk Management Plan documents the

procedures, processes and tools that will be adapted to manage and control those events

that have positive and negative impact on the operation and production. The plan will

addressed its Scope and Approach; Risk Identification; Risk Analysis; Risk Response

Planning; Risk Plan Implementation; Risk Tracking, Monitoring and Control and Risk

Management Implementation (Gray & Larson, 2006).

This report will illustrate a Risk Management Plan for Petron Corporation specifically

and limited to its oil refinery operations. Safety in an oil refinery heavily relies on it

adopted Risk Management criteria. By definition, the oil refining enterprise is exposed

to market risk, counterparty risk, contractual risk, operational risks, health risk, safety

risk, environmental risk, IT risk, security risk, political risk and regulatory risks. The

Risk Management Plan reflects these risks and will aim in achieving Petron

Corporation’s vision, mission and business objectives (Neste Oil Corporation, 2005).

2.0 Scope

Petron Corporation is the largest oil refining and marketing company in the Philippines.

The company is currently supplying nearly 40% of the country’s oil requirements. The

company considers its world-class products and quality services as a fuel to the lives of

millions of Filipinos.

Petron Corporation’s vision is to be the leading provider of total customer solutions in

the energy sector and its derivative businesses. The company’s missions are the

following:

Being an integral part of our customers’ lives, delivering consistent customer

experience through innovative product and services;

Developing strategic partnerships in pursuit of growth and opportunity;

Leveraging our refining assets to achieve competitive advantage;

Fostering an entrepreneurial culture that encourages teamwork, innovation and

excellence;

Caring for the community and environment;

Conducting ourselves with professionalism, integrity and fairness;

Promoting the best interest of all our stakeholders.

Petron Corporation operates a refinery in Limay, Bataan, Philippines with a rated capacity

of 180,000 barrels a day. Its Integrated Management System (IMS) certified refinery

processes crude oil into a full range of petroleum products including gasoline, diesel,

liquefied petroleum gas (LPG), jet fuel, kerosene, industrial fuel oil and petrochemical

feedstock benzene, toluene, mixed xylene and propylene.

From the refinery, Petron transports its finished products primarily by sea to 32 depots

and terminals which are strategically located in the different parts in the country. Using

this nationwide network, Petron Corporation supplies diesel, fuel oil and Liquefied

Petroleum Gas (LPG) to several industrial users. Petron Corporation is also the supplier

of jet fuel at several airports for international and domestic air carriers.

Petron Corporation retails gasoline, diesel and kerosene to its 1900 service stations.

Liquefied Petroleum Gas (LPG) is sold through its dealership network for household and

industrial consumers.

Petron Corporation operates a lube oil blending plant with its lubes and greases product

line which is located at Pandacan Oil Terminal. This product line is sold through its

service stations. To cater to the demand of fuel additives, Petron has also a blending

facility at Subic Bay Freeport. This gives Petron the capability to manufacture unique

additives for the production of premium fuels.

Petron Corporation also exports various petroleum and non-fuel products to Asia-Pacific

countries such as Japan, India, Malaysia, Singapore, South Korea, Thailand, Pakistan and

United Arab Emirates.

Petron Corporation operates an oil refinery in Bataan, Philippines; distributes and markets

its products from the refinery all over the country. Apart from this, Petron operates a

blending facility in Pandacan, Philippines and Subic Bay, Philippines. The scope of Risk

Management Plan is only limited to its oil refinery operation and not its distribution,

depot operation and likewise with its nationwide marketing of its various products. This

Risk Management Plan also will not cover both the blending facilities’ operations.

Furthermore, this Risk Management Plan will not include its operations for its export

distribution business.

Any kind of perceived risks pertaining to the nature of Petron Corporation’s oil refining

operation will be taken into consideration with this report and the risk associated with its

location particularly the Philippines.

3.0 Risk Fundamentals

The purpose of risk management within Petron Corporation is to protect its assets,

finances and operational and strategic position and opportunities through its effective

management practices. The company considers a risk as any event that could prevent the

operation from progressing as planned or otherwise from having safe and efficient

manufacture of its products. Petron Corporation follows an enterprise-wide risk

management framework for identifying, mapping, and addressing the risk factors that

affect or may affect its businesses.

3.1 Identification of Risk

The risk management process begins by trying to generate several list of possible

risk that will affect the efficiency of the production in its refinery.

Bottom-up approach – The Company’s management process is a

bottom-up approach, with each division mandated to identify risks. More

than 80 risks are identified by the Petron Risk Management System’s

bottom-up approach. This approach mandated each division of the

refinery production to conduct regular identification of risks. The bottom-

up approach identifies risk at a low level. All personnel will participate in

the identification of risk process and the update of the risk definition.

Since, Petron Corporation operations form an integrated value chain, risks

emanate from every process. The identification of risk flow up to the

management committee and to the board.

Checklists – This approach is not considered in the identification of risks,

although this is considered as fast in anticipating risk. However, a simple

checklists can be questioned if it is useful since each division processes

are unique. In this case, checklist can be rendered inadequate in the

identification of risk. Checklists lead to more paperwork and its

advantages outweigh the paperwork involved. On the hand, each division

of the company may include very specific points that checklists cannot

verify. Therefore, people from the bottom-up are the great source to

discover risks.

Brainstorming sessions – This approach in which core team members

from different divisions together with other relevant stakeholders uses

brainstorming to identify risk is not considered in this case. This type of

approach in which a special risk meeting will be organised in order to find

risk can sometimes become chaotic if a brainstorm shifts from finances to

strategy and back to technology in a short period of time. Aside from the

reason that meetings can be time consuming if it will be very lengthy

since each team member have a lot of risks on their minds.

SWOT exercises – This approach in which the positive and negative risks

(Strengths and Weaknesses) inside Petron Corporation and the impacting

risks from the external environment (Opportunities and Threats) structure

in identifying risks. This structure will be used in the brainstorming of all

possible risk. The same disadvantages in using the brainstorming sessions

approach can be applied. Therefore, this is not put into consideration in

the technique use in the identification of risks.

Regular productive meetings – In the bottom-up approach, regular

meetings were conducted by employees involved in each division in order

to identify risks.

The following ways in identifying risks was not considered as techniques to

be used in Petron Corporation:

Behavioural Models –

Diagramming techniques –

Flowcharting project and Process Models –

3.2 Classification of Risk

Risk can be classified into positive or negative risk. The Petron Risk

Management System classifies major risks as having the relatively high

probability of occurring and a substantial adverse financial impact. The major

risks that the company identified and classified are:

Business Risk

Financial or Interest rate risk – This risk involve possible losses due to

the fluctuating interest rates that is inherent to the Philippine economy.

Foreign exchange risk – This risk comes from the difference in the US

dollar denominated assets and liabilities when it will be converted to

Philippine Peso since this currency are used by Petron Corporation as its

functional currency.

Credit risk – This risk is about the exposure of Petron Corporation’s

financial assets to this kind of risk as shown on the statement of financial

position.

Commodity price volatility risks – These risks emanates from the

exposures to fluctuations in the prices of crude oil and products in the

world market.

Liquidity Risk - This risk is the outcome if there are adverse changes in

the business environment or internal operations that will result to a

substantially higher working capital requirements and the presence of a

difficulty in financing additional working capital.

Other market price risk – Risk that will result from investments carried

at fair value.

Political Risk

Regulatory Risks – These risks come from changes in national and local

government policies and regulations which can result in substantial financial

cost for the company, either directly or indirectly.

Operational Risk

Risk of operational disruptions – This risk emanates from accidents, process

or machinery failure, human error, adverse events outside of human control

and delays in major capital expansion projects.

Catastrophic and environmental risks – These risks will come from external

factors. Petron Corporation will have to recognise the need to include climate

change as this pose a significant risk to the continuity of its operations. This

was proven during Ondoy storm that several service stations were forced to

shut down due to heavy rains that caused flooding.

3.3 Main Sources of Risk

Risk has its main sources or origins both within and outside Petron Corporation’s

organisational structure.

External Sources of Risk

International Oil Market – changes in crude oil and products prices.

Philippine Economy – fluctuations of interest rate and foreign exchange

rate.

Environmental conditions – affects the operations continuity

National and Local Government regulations – result in financial and

other costs.

Internal Sources of Risk

Process Failure

Machine Failure

Human Error

3.4 Measurement of Risk

In Petron Corporation, negative risk is measured according to its relative high

probability of occurring and a substantial adverse financial impact. These risks

were classified as the major risks by the company’s Petron Risk Management

System. The major risks were the one identified above where measured using

this method.

3.5 Risk and Hazards Analysis

The major risks that will be identified by Petron Risk Management system

structure are prioritised at the management level through comparable quantitative

assessments of impact and likelihood. By design, the system mainly addresses

threats to profitability under the Petron Sustainability Framework. As mentioned,

the system’s main focus is how to protect and enhance the company’s

profitability by prioritising risks.

Likelihood/Impact Matrix

Petron Corporation does not consider this Risk and Hazard Analysis:

Probability / Severity Matrix

Furthermore, the company is not considering the following qualitative approach

in Process Hazard Analysis:

Failure Modes and Effects Analysis (FMEA)

Failure Modes and Effects Criticality Analysis (FMECA)

Hazards Analysis Study (HAZOP)

Event Tree analysis (ETA)

What-if/Checklists

Also with the quantitative risk assessments which are the following are not

considered by the company:

Fault Tree Analysis (FTA)

Event Tree Analysis (ETA)

Statistical Analysis

Process modelling

Event probabilities

Risk/cost trade-off

However, Petron Corporation’s Board of Directors creates the Audit Committee

which has the authority and responsibility in managing risk and also ensures the

integrity of internal control of Petron Corporation’s activities. Aside from this,

the Board of Directors also authorise a Compliance Officer that will also

identifies and monitors compliance risks.

4.0 Risk Management Methods

4.1 Risk Assessment This process is the activity that will determine the likelihood that a risk will occur and the impact that an event would have or should it occur. This is also called a “cause and effect” analysis. The “cause” is the event the may occur, while the “effect” is the potential impact to the operations of Petron Corporation if the event may occur.

Assessment of a risk by the Petron Risk Management System involves two factors. First the likelihood which is the measure of certainty that an event or risk may occur. This can be measured from Low, Medium or High. The second factor is estimate of the impact on the operations. Although, this is considered as a subjective assessment, the risk should be quantified whenever or however possible. This factor is estimated from Minor, Moderate to Significant. In estimating impact Cost, Scope, Schedule and Quality is considered since this will be affected by the impact.

This system is used to compare one risk to the other and make prioritisation possible. As a result, the mitigating measures on major risks can be prioritised in order to protect and enhance the company’s profitability. Petron Corporation will maintain the quality of its quantitative approaches and ensure that the main aspects will be enhanced.

Risk assessment from all levels of Petron Corporation Organisational Structure

4.2 Risk Analysis

Risk analysis in Petron Corporation through its Petron Risk Management System develops an understanding of the risk. It will provide information for decision making on whether risks involve need treatment by the most appropriate and cost-effective risk treatment strategies that will be implemented by top management.

Risk analysis will aim to establish an understanding of the level of a certain risk and its nature. This process will ascertain the absolute level of risk and on the other hand will assist in determining the priorities. In Petron Corporation the level of risk is determined by combining likelihood and impact.

Petron Risk Management System has developed a risk assessment tool which allows risks identified to be assessed and recorded from bottom-up in its organisational structure. Likelihood and Impact tables are used to provide definitions for the rating scales so the Petron Risk Management system will have a common understanding of the meaning within the organisation. In its bottom-up approach, all personnel from all levels of the organisation will participate in

this quantification process of Petron Risk Management System. Hence, this system also will serve as an empowering tool up to a certain degree across the organisation.

Peron Corporation follows an enterprise-wide risk management framework, Petron Risk Management System cuts across divisions and will attempt to cover the widest possible spectrum for covering risk. The system will touch on concerns with the environment regulatory and socio-political issues, strategic partnership, continuous project innovation and other identified risks that makes up the 80 risks identified. Petron Risk Management system will undertake different but parallel journeys.

There are three steps in the risk analysis process:

Consider the likelihood of risk – what is the likelihood that the risk may actually occur within the existing controls. The personnel will choose the description which is best suits the likelihood of the risk occurring based on the risk assessment tools used.

Consider the impact of the risk – this is based on what happened in the past and what could possibly happen in the future. The personnel will also select a descriptor which will best reflect the impacts of the risk in relation with the existing controls that are already placed.

Calculate the risk – calculate the risk by matching the impact rating and the likelihood rating on the Risk Matrix.

Risk rating using the Likelihood/Impact Risk Matrix

The risk assessment tool above is one example on how likelihood and impact is measured in order to have a structured approach across the organisation. All personnel will examine the following likelihood table and will analyse about what examples of events in Petron Corporation have occurred. This will assist on how likely the identified risk is to happen. The range of likelihood is from “Almost certain” to “Rare”.

On the other hand, the personnel will at the same time look at the impact at such rick occurring on the Impact and determine the range from “Insignificant “ to Catastrophic”. When both likelihood and impact rating are plotted on the Risk Rating table, this will give a risk category from “Low” to “Extreme”.

Impact Matrix

4.3 Risk Evaluation

The aim of risk evaluation in Petron Risk Management System is to make decisions that are based on the outcomes of its Risk Analysis. This process will determine which risks need priority treatment and in the other hand which activities should or should not be considered to take. The main objective of this process is to ensure that effective strategies will be in place in order to minimise the frequency and severity of any identified risks.

In Risk Evaluation, the process will assess risk tolerability decisions and analyse at the same time different options. The table below will show different levels of risk tolerance.

4.4 Risk Control

There are four risk control options available and can be used by Petron Risk Management:

Risk Avoidance – making decisions or taking actions which ensure that the risk involve cannot possibly occur.

Risk Reduction – making decisions or taking actions which will reduce the likelihood of a risk occurring.

Risk Mitigation – making decisions or taking actions which reduce the impact of a certain risk if it will occur.

Risk Transfer – making decisions, taking actions and establishing management systems for the risk or responsibility to finance the effect of risk if it will occur.

The choice of which is the best risk control to be used will be based on many variables such as cost, human resources and the degree of difficulty of a particular option.

5.0 Risk Management Plan

5.1 Scope and Approach5.2 Risk Identification5.3 Risk Analysis5.4 Risk Response Planning5.5 Risk Plan Implementation5.6 Risk Tracking, Monitoring and Control5.7 Risk Management Implementation

6.0 Compliance with Risk Management Standard7.0 Conclusion