Risk Management Plan for ExxonMobil: Key Risks Analyzed

Introduction and Organizational Context

A risk management process is a systematic application of management policies for the purpose of identifying, analyzing, evaluating, and mitigating possible risks within an organization. This paper focuses on the formulation of a risk management plan for ExxonMobil, one of the world's most renowned oil and gas companies. Applicable risks are identified and evaluated, and a risk treatment plan is then proposed for each.

Being in the gas and power marketing department of the company, there are certain risks applicable within that area of operation. In order to clearly determine those risks, a comprehensive look at ExxonMobil's organizational processes along with a SWOT analysis is presented first. The firm is dedicated to creating and maintaining an environmental policy that protects the environment on a long-term basis. It is committed to providing customers with technology-driven products and services in the form of fuel efficiency and reduced oil emissions (ExxonMobil, n.d.). For this purpose, it must comply with policies and regulations emanating both from government bodies and from the organization's own management, so that structured steps can be taken for the protection of the environment.

The goals and tracking processes are designed so that costs and benefits are considered in the light of environmental standards, regulations, and governmental laws. The firm believes in following an Operations Integrity Management System (OIMS) throughout its global operations in accordance with ISO 14001 and OHSAS 18001 occupational health and safety requirements (ExxonMobil, n.d.). Driver safety is a top priority and is ensured in ExxonMobil products, with diligent investigations revealing that fewer than one passenger per million driven miles faced an accident (ExxonMobil, n.d.). In addition, the company recognizes its responsibility toward society and invests in education, health, environmental conservation, and employee involvement.

Risk Context and SWOT Analysis

SWOT Analysis

Strengths: ExxonMobil is one of the strongest names in the oil and gas industry. It has strong financial growth on a yearly basis and worldwide retail operations in several countries with more than 3,000 employees. It has made significant investments in research and development and maintains a remarkably vertically integrated supply chain, from drilling oil to producing numerous goods.

Weaknesses: Employee management around the world is weak. The firm faces legal and human rights issues, and due to the actions of some employees, it has been accused of fraud and bribery cases in global operations. It has also faced issues regarding environmental hazards and oil spills — most notably the Valdez oil spill in 1989.

Objectives and Scope of the Risk Management Process

The key operations or services that need to be assessed for the risk management process involve the strategic planning department, the legal department, and the finance department. As a member of the gas and power marketing department, four major risks to the overall company — discussed in subsequent sections — are related to these departments. These departments therefore need to be efficient in identifying those risks and mitigating their effects for the overall business health of the firm.

Human resources and technology are vital for these operations, as employees are needed to operate machines and produce results based on research so that risks can be identified and addressed in a timely manner. The role of a gas and power marketing officer is to research risks and their outcomes so that marketing becomes more effective. If there are significant risks in the global oil and gas industry, it becomes difficult for any department — including marketing — to perform well. It is therefore necessary to determine the risks associated with the respective departments and alleviate them in order to promote the firm's standing worldwide.

Persons to Be Consulted for Risk Management

The following individuals within the organization should be consulted for risk management:

Risk Officer: Responsible for leading the risk management plan, encouraging communication across departments, executing the risk management plan, and many other related tasks.

Strategic Planning Department Head: Consulted to probe deeply how the risk management plan would be executed and what steps should be taken to position the firm strategically within the industry in order to minimize risks.

Legal Department Head: Legal affairs are critical when implementing change or analyzing risks. ExxonMobil's legal department would be consulted to highlight laws that might play a role in the risk management process.

Finance Department Head: Consulted to estimate how much the risk management process would cost and what benefits could be generated in the form of future profits.

CEO: The CEO would be notified before all other department heads so that the organization's leadership understands what processes are taking place and how they would affect the firm's performance in the short and long run.

Shareholders: Meetings would be arranged to consult shareholders, as they have stakes in the firm and should be informed about both the positives and negatives of the business. Their opinions carry significant weight because they are directly affected by profits and losses arising from the risk management process.

Risk Management via the ISO 31000 Framework

The ISO 31000 framework for risk management provides a structured set of steps for implementing a risk management process (Institute of Risk Management, 2010, p. 7):

i. Mandate and commitment from the board: Following meetings with shareholders, a commitment to risk management implementation would be secured to minimize risks and improve ExxonMobil's performance.

ii. Design of the framework: The framework would be designed with the help of department heads and the CEO in a dedicated meeting, allowing each department head to present a cost-benefit analysis for their area and enabling the CEO to determine the best course of action for the overall firm.

iii. Implement risk management: Implementation would be decided after both the shareholder meeting and the CEO-department head meeting, so that crucial steps could be outlined and an implementation timeline established.

iv. Monitoring and reviewing the framework: This step is of paramount importance, as any oversight or errors can be identified for better implementation and results.

v. Improving the framework: If weak areas in the plan are identified, room for improvement would be created so that future risks can be further attenuated.

Critical Success Factors for the Risk Management Plan

The foremost critical success factor is the loyalty, honesty, and dedication of the firm's staff — from the highest executive to the lowest worker in the hierarchy (Ranong & Phuenngam, 2009, p. 31). This is an important requirement, as ExxonMobil has suffered in the past from employee dishonesty resulting in bribery and oil spills. Top management must cultivate trust among employees and ensure they are rewarded and acknowledged for their contributions to the risk management process. Training can also be provided to employees where required, representing another critical success factor.

Second, communication plays a vital role in the risk management process. Departments can communicate through emails, telephone, meetings, fax, and other channels. Third, organizational structure and culture are helpful in developing risk management strategies, since a strong culture embeds strong values into employees' work patterns and increases their commitment to goals such as risk management. Fourth, effective use of information technology can be transformative in the risk management process, as storing and protecting important information is mandatory throughout this course of action. If important information is mishandled or falls into the wrong hands, risk increases rather than decreases.

Identifying the Four Key Risks

Four risks have been identified within scope in accordance with relevant policies, procedures, and legislation, in order to ensure that reasonable steps are taken for their identification. The underlying causes of each risk are noted so that mitigation decisions are better informed. Relevant departments were contacted to assist in the identification process.

1. Political Risk: This is an externally driven risk of concern to the legal department, risk officer, CEO, and shareholders. Different countries where ExxonMobil operates have varying regulations governing how, where, and when oil and gas extraction is conducted. The underlying cause is that a country originally deemed politically stable may later prove otherwise, no longer matching the firm's operating preferences. ExxonMobil must select states where governments allow easy granting of long-term leases. Changing political scenarios can also bring drastic changes to the regulatory environment, and a host country may alter the terms of an existing contract in pursuit of greater profits.

2. Geological Risk: This is also an externally driven risk factor. The most easily accessible oil and gas extraction sites have already been claimed by other companies, or are in the process of being developed, forcing ExxonMobil to seek resources in less hospitable environments such as deep oceans. Although advanced technology has enabled extraction from sites once considered impossible, difficulties persist. The parties consulted for this risk include the risk officer, strategic planning department, CEO, and shareholders. The firm's geological researchers identify suitable extraction sites and classify them as "proven" or "probable" based on strategic estimates. If these estimates are wrong, the company faces significant wastage of resources and time.

3. Global Price Risk: This risk is also externally driven, as global oil prices are volatile and affect a reserve's economic feasibility. High geographical barriers to easy extraction can render projects economically unviable. It is sometimes impossible for oil and gas companies to shut down a project when sudden price changes occur. ExxonMobil must therefore forecast prices accurately over the long term. The parties to be consulted for this risk include the risk officer, CEO, shareholders, and the finance department head.

4. Weak Internal Control and Fraud: This is an internally driven risk factor caused by deceitful acts of certain employees in the past. Stronger internal controls would have prevented employees from jeopardizing the firm's interests. Illegal acts such as bribery caused negative publicity and substantial financial losses. Reinforcement of control factors — including integrity, ethical values, and competence — would have produced more positive outcomes. Fraud also resulted in punitive damages following the lawsuit related to the Valdez oil spill. It was alleged that ExxonMobil failed to stop the leakage due to ineffective action and weak monitoring. Another fraud accusation arose in 2006 regarding an underground gas leak in Jacksonville, as the firm was accused of not prioritizing the potential harm of contamination (Hirsch, 2011). The relevant parties for this risk include the risk officer, CEO, and shareholders.

The table below summarizes the four identified risks, the parties consulted, their possible impacts, and the relevant success factors.

Table 1: Simple Risk Table

Risk 1 — Political Risk: Parties consulted: Legal department, risk officer, CEO, and shareholders. Possible impact: Changes in regulation due to changing political environments may disturb oil and gas extraction operations and ultimately reduce profits. Success factor: Communication between ExxonMobil and the governments of host countries.

Risk 2 — Geological Risk: Parties consulted: Risk officer, strategic planning department, CEO, and shareholders. Possible impact: Wastage of company resources and time if geological estimates prove incorrect. Success factors: Information technology, firm staff, and communication.

Risk 3 — Global Price Risk: Parties consulted: Risk officer, CEO, shareholders, and finance department head. Possible impact: Wastage of company resources and time. Success factors: Information technology, firm staff, and communication of correct estimates.

Risk 4 — Internal Control and Fraud: Parties consulted: Risk officer, CEO, and shareholders. Possible impact: Negative publicity, punitive damages, and financial losses. Success factors: Honesty of ExxonMobil's staff, communication, information technology, and organizational structure and culture.