​COVID-19 has shone a spotlight on the risk management practices of energy and natural resource (ENR) companies, highlighting weaknesses in identifying emergent and long-term risks and trends — and made all too real the effect that external shocks can have on the operations, sales and profitability of companies.

“The biggest impact of the pandemic globally has been to highlight the vulnerability of companies to external shocks. It’s something that investors have picked up on,” says Atin Prakash, Senior Manager of Sustainability and ESG Services with KPMG in Canada. A company can be following common industry practices, yet still be vulnerable to external factors such as natural disasters or pandemics.

While it can seem like these events come out of the blue, it’s still possible for companies to anticipate and make plans to mitigate the impacts — even if it’s difficult to predict their timing or magnitude. “Events like COVID-19 often get labelled as ‘black swans’ that no one could have predicted. But often, when people work through a comprehensive risk process, it becomes apparent that some of these events were predictable, but they just weren’t looking in the right areas,” says James Barr, Partner, Risk Consulting, KPMG in Canada.

Companies need to get better at identifying emerging risks

“The pandemic has reminded us that one of the key things organizations can do a better job of is to consider emerging risks,” says Barr.

Firms generally do a good job of managing the risks they know about now but need to spend more effort looking at what’s coming. That involves watching for signals of change by monitoring emerging trends that are taking place beyond their company, and even industry, which could affect their future business. These signals of change can include technology that’s relevant to their industry, consumer preferences, overall patterns in the economy and broader geopolitical issues.

For instance, some mining companies are using autonomous vehicles for haulage. If a mining company isn’t doing this or is late to the game, will it remain competitive? What are the implications of major international consumers of Canadian resources exerting more influence around the world and actively seeking to purchase their own Canadian production? And how will the rising importance of environmental, social and governance (ESG) affect the ENR space?

Concerns about climate change have also had significant impacts on the ENR sector. Some of these, such as increased demand for green energy, have come directly from consumers. Others have come from governments reacting to political pressure, with such measures as environmental regulations, the imposition of carbon taxes and even forced shuttering of some industry segments, like coal-fired power plants. Companies that identified and monitored these emerging concerns around climate in the previous decades — before they gained momentum — were better prepared for the changes that developed.

Heightened operational risks in a changing world

While climate change concerns remain important for the ENR sector, new issues are evolving as the pandemic is changing the way companies need to approach ESG.

“COVID-19 has increased attention on diversity and inclusion issues globally,” says Prakash. Stakeholders are paying more attention to the way firms treat their employees, and there’s pressure on organizations to ensure their customers and business partners are safe when interacting with the organization.

The way employees are treated can directly influence the financial health of a company. If the organization does not address proper COVID-19 measures for employees, for example, there could be a detrimental effect on employee morale and productivity, besides potential disruption to operations. “The pandemic has not only highlighted ESG and externalities but it has made them financially material,” says Prakash.

The pressure put on employees during such crises as the pandemic can create risks of its own. For example, it can put pressure on management to not only manage the crisis, but also to maintain certain levels of performance — and this can create an atmosphere where controls are left aside, resulting in a higher risk of fraud. “The audit committee needs to understand where there has been an override of controls. Management may have said they’re not doing it this quarter because there isn’t time,” says Julie Pépin, Partner, Internal Audit, Risk and Compliance Services, with KPMG in Canada.

The importance of whistleblower policies

Under these conditions, it’s important for audit committees to make sure they reinforce the whistleblower line. “There’s a lot of pressure on employees during crises. They may have more work to do, or getting their work done might be more complicated. The whistleblower line is a way of becoming aware of anything that could have an impact on controls or fraud over financial statements,” says Pépin.

The pandemic has also highlighted the importance of evaluating risk originating from business partners. At the start of the pandemic we saw global disruption in supply chains, which highlighted the importance of third-party risk, says Barr. Monitoring this risk has become even more critical as most large organizations now outsource administrative functions such as payroll and regulatory compliance. Third parties need to be monitored for their broader risk management practices, cyber security, adherence to ESG practices and ability to weather external shocks.

Only a few years ago, ESG reporting by Canadian ENR companies was seen as a leading practice, but now it’s widely done — and it’s expected. ESG reporting is also converging with financial reporting. Financial regulators are starting to see ESG as having a material impact on company performance and want it treated in the same way as financial reporting — with comparable standards and oversight.

Regulators are looking at what type of data should be published and what standards should be followed. There’s still much work to be done in this regard, but most reporting in Canada currently satisfies the requirements of: the Sustainability Accounting Standards Board (SASB); the Task Force on Climate-related Financial Disclosures (TCFD), created by the Financial Stability Board; and the Global Reporting Initiative, an independent international sustainability reporting organization, that provides guidance on standardized reporting on sector-specific impacts.

Audit committees and auditors will be increasingly expected to consider aspects of ESG. “The ESG culture of a company trickles down from the top,” says Prakash. Board members and audit committees need to maintain current knowledge of what ESG means for the company and receive regular reports on the company’s ESG performance.

Prakash believes diversity and inclusion is the next area of ESG that’s going to take on more importance. There is already an increased focus, with diversity and inclusion being correlated with improved economic productivity and better management decision-making at companies. This is expected to be followed by a focus on biodiversity loss which will be of importance to companies in the ENR space because they interact directly with the natural environment and may face issues around land acquisition and resource usage.

Stress and scenario testing

In addition to watching signals of change, firms can use scenario testing, stress testing and reverse stress testing to look for emerging risks. Reverse stress testing starts with identifying a failure or catastrophic event, working backward to determine ways it could occur and then identifying the risk factors that contribute to these happening.

Scenario testing involves outlining a scenario, determining how likely it is to happen and what its impact would be on the company. For instance, the scenario might be centred on the future possibility of a domestic or foreign government halting a project, such as a pipeline, that’s already underway, or facing an unexpected tariff imposed by another country.

Once risks have been identified, organizations need to look at risk velocity, says Barr. Risk velocity measures the time that passes between a risk event and when the organization feels its effects. Knowing the velocity helps firms make better decisions about how and when they mitigate risks and how they spend money to do so.