Annual Report 2010 - SBM Offshore

Risk Management
Risk Management operates on three fronts through a
standard process of risk identification, risk assessment,
and risk mitigation actions. Firstly, business processes
are subject to risk assessments and key controls are
updated where necessary. Continuing projects initiated
in previous years, additional Internal Control workshops
took place, particularly related to Financial Reporting.
Secondly, major projects are subject to ongoing risk
workshops by an independent Risk Management
team from early in the proposal phase until project
completion. The dedicated Project Controls department
continued to work on specific improvement
initiatives in the field of project execution. An important
development in 2010 was the introduction of a formal
Independent Project Review (IPR) process. The Project
Risk Management process is reinforced by dedicated
Legal, Quality Assurance, Health, Safety, Security &
Environment (HSSE) and Internal Audit departments.
Risk Management was reinforced during the year with
the roll-out of a bespoke, on-line risk management tool
“eRisk”. The principles of Risk Management in SBM
Offshore are:
• integration of Risk Management into the general
management process;
• comprehensive Risk Management assurance based
on a matrix of agreed objectives at risk and analysis
of the complete spectrum of sources of risk to be
analysed;
• communication involving all critical personnel contributing
to the Risk Register;
• agreement on mitigating actions and controls in a
risk workshop;
• Risk Management function providing facilitation,
monitoring and reporting to Company Management.
The policy of SBM Offshore is to accept risks which
are inherent to its business activity, that are within its
risk appetite and for which it has competence and an
agreed control process.
Controls
To ensure good Corporate Governance, the Company
maintains a documented system of key processes
and controls. The Company recognises the need for
Report of the Board of Management
ongoing development in this area and attention is being
devoted to assess the effectiveness of those processes
and key controls as well as the application of a continual
improvement process. Financial reporting controls
were reviewed and tested in detail in each of the project
execution centres, using a risk based approach. This
process will continue in all other departments based on
an objective and risk assessed approach. IT controls
were tested by an external party with results showing a
strong level of protection and continued improvement
over recent years.
Information systems
The Company maintains a relatively flat organisation
structure with short lines of communication. Information
flows upwards to the appropriate department managers
and decision making is made in consultation with
other department managers where necessary. The
Company has requested an external review of its information
systems network. The first conclusions are that
the systems support the business activities and there
are no areas of major risk. As expected, there is opportunity
for optimisation and improved integration of the
various reporting systems. Project teams were formed
and a consultant employed to help identify the process
weaknesses and information gaps and propose a roadmap
for the future.
Internal assurance
Conformance to Audit standards and compliance
with Company procedures (GMS) are under the
joint responsibility of the Internal Audit and Quality
Assurance disciplines. Both operate independently
from the business line functions and report directly to
the Management Board and the Audit Committee. The
objective of Internal Audit and Quality Assurance is not
only compliance testing in respect of procedures and
controls but also to form an independent opinion on the
effectiveness of the underlying processes and controls.
The audit functions of these two disciplines are planned
to be combined in 2011.
To best monitor compliance activities, the Internal
Assurance process has been designed to consolidate
all Corporate and Divisional audits. It is constructed
using a variety of tools, including information from both
SBM Offshore – Annual Report 2010 87