ERM at Hydro One

Given the overwhelming incentives and pressures to employ an enterprise-wide approach to risk management, we are surprised
that more firms are not doing so. One deterrent is the scarcity of case studies describing successful implementations of ERM.Hydro
One paper
The purpose of this case study is to fill this gap in the literature by providing the process by which one firm, Hydro One Inc., has successfully
implemented ERM.Hydro One paper
1.

Background. H1 is a Canadian company which delivers electricity. H1 was initially state owned, although this changed over
time, as Canada deregulated its electricity markets.

2.

Hydro One (H1) was a relatively early adopter, starting the process in 1999.

3.

The driver was that H1 wanted to look at risks and opportunities in an integrated way that would lead to a better overall
allocation of corporate resources.

4.

Initially the ERM implementation was led by external consultants, "... but no lasting benefits or transfer of knowledge appear
to result from those initiatives."

5.

In late 1999 the position of Chief Risk Officer was created, with the head of internal audit, John Fraser, being appointed to
the role on a part-time basis.

6.

There were two other risk management staff: both had professional "non-risk" qualifications in the areas of process reengineering and industrial engineering.

7.

A corporate risk management group (CRMG) consisting of these three people was set up to progress the development of
ERM in H1.

8.

The group was given six months to prove its worth; if it failed the ERM concept would be abandoned and the CRMG
dissolved.

9.

In early 2000 the CRMG took an ERM policy and ERM framework to the executive risk committee (ERC) for discussion.

10.

The ERC suggested a pilot study be undertaken with one of H1's small subsidiaries, after which formal approval of the risk
policy and framework would be sought from the board's audit committee.

11.

In Spring 2000 the CRMG held its first ERM workshop. This covered the normal material of risk identification and
assessment, but went beyond the standard brainstorming approach:

The CRMG developed 80 risks, emailing them to the subsidiary's management team.

Each manager chose his top 10 risks.

Based on the various choices, the CRMG chose the 8 top risks.

The management group voted on their relative importance, using the Delphi method.

Outcomes and outputs included:

Business objectives were not always clearly articulated. The workshop helped achieve this clarity.

The discussion of preliminary action plans.

Risk "Champions" were given the responsibility of developing more concrete action plans.

Issues that managers have thought about but never openly discussed were addressed.

Some new risks were identified, while concerns about some risks were allayed.

Participants were asked to evaluate the quality and benefits of the workshop.

12.

The ERC considered that the pilot study had been a success.

13.

In Summer 2000 the Audit and Finance Committee approved the CRMG's proposed risk policy framework notes. The
roadmap for implementing ERM H1 was established.

ERM objective
The overall aim of H1's ERM framework is not risk elimination or risk reduction per se, but rather attainment of an optimal balance between
business risks and business returns.Hydro One paper

Risk definition
The ERM policy of H1 defines risk as follows:
The potential that an event, action, or in action will threaten H1's ability to achieve its business objectives risk is described in terms of its likelihood
of occurrence and potential impact on magnitude. Broad categories of risk in H1 include strategic, regulatory, financial and operational
risks.Hydro One paper
This is interesting; despite the fact that H1 did not only think of risk management in terms of the downside, there was still an
association of risk with "events".
Risk and objectives
Given the definition of risk, H1's objectives needed to be clear. But the CRMG found that:
... objectives were not always clearly articulated, and that the workshop process from the pilot study helped in achieving clarity of business
objectives.Hydro One paper
Interestingly the paper notes that ERM has become such an integral part of the workplace that the CRO is now becoming a lowmaintenance position within the company. This is in contrast to normal risk management development, which might see the CRO
being a full time role with the incumbent being appointed to the board.
Risk assessment
Although H1 used a variation on probability-impact risk assessment, it is clear that their thinking on risk assessment was
reasonably well developed:
In theory, the correct way to portray the estimated effect of the risk is to use a probability curve that reflects the potential outcomes and associated
probabilities.Hydro One paper
Nonetheless H1 decided that given the practical difficulties of "building" such a curve. It should focus on the "worst credible"
outcome and its associated probability of occurrence. It is unclear how H1 overcame the theoretical difficulties, but perhaps the

"the worst credible outcome" was a range, starting at some undesirable outcome. Once again this outcome was identified using
workshops and the Delphi method.
Controls
At an early stage H1 developed a "control strength" model; 1 represented few controls and 5 represented full prescriptive controls
with executive oversight. H1 acknowledge that the drivers for development of controls included not just risk but also the potential
cost of controls. This seems obvious, but is usually unacknowledged in risk management literature.
Another indication of good thinking is the explicit acknowledgement that risk can be reduced via likelihood or consequences. H1
thought that new or enhanced preventive controls address the likelihood point, while consequence was managed through some
form of contingency plan.
Controls and action
Project

Level

Cost
($)

Cumulative
cost

Risk if not
done

Bang for
buck

Tree trim

Highest

4.6

N/A

Lines

Highest

4.5

N/A

Poles

Highest

3.9

N/A

Minimum

10

2.8

2.8

Lines

Level 1

13

3.0

1.0

Tree trim

Level 1

15

1.9

0.95

Lines

Minimum

20

3.2

0.64

Poles

Minimum

12

32

2.3

0.19

Tree trim

The "risk if not done" column is also the risk reduction, which would be achieved if the control was implemented. Those programs
which were thought to be at the highest level of risk (the top three programs) were deemed to be intolerable risks; they must be
mitigated.
The cost for each variable mitigation was estimated. The "Bang for Buck" is simply the "risk is not done" divided by the cost. Using
this simple approach H1 used up their "mitigation budget" by first addressing all the intolerable risks and then working down the
others, largest bang for buck first.
Integration with the core business
This simple example shows that H1 succeeded at an early stage in integrating risk management with the core business. Indeed the
table above looks less like a risk register and more like a simplified business case for action on each project. All projects are subject
to uncertainty. Whether this uncertainty is "downside" or "upside" depends on where we set the baseline.
Benefits of ERM and outcomes at Hydro One
#
(note
)

ERM Benefits

Hydro One Experiences

Lower cost of debt

Realised higher debt rating and lower interest costs than expected. Saving of $1m
p.a. Ratings analysts stated ERM was a significant factor in the ratings process for
H1.

2 (1)

Better capital expenditure process

The capital expenditure process was based on greatest risk mitigation per dollar
spent and was regarded as optimal. ERM was also used in the management of
major projects such as utility acquisitions and the potential building of an
underground cable to the US.

3 (2)

Avoid surprises

Since starting ERM there have been many "unusual occurrences" at the company.
To significant surprises were analysed ahead of time.

1 (1)

#
(note
)

ERM Benefits

Hydro One Experiences

4 (2)

Reassure stakeholders that the

business is well managed

This was important as H1 proceeded to IPO.

5 (3)

Improve corporate governance

H1 directors recognise that H1 is ahead of other companies on whose boards they

sit.

6 (3)

Implement a formalised system of

ERM

H1 have such a system.

7 (4)

Identify where H1 can manage risks

better (or worse) than others

Through this approach subsidiaries were sold and various processes were
outsourced.

Notes
1.

These are "hard" measures which have an obvious economic benefit.

2.

A traditional purpose of risk management, but none the worse for that.

3.

These are seemingly compliance-driven points. We would have liked to have seen something on exploiting the knowledge of
non-executive directors.

4.

This point, although "soft", would seem to have economic benefit. We would have expected its ranking to be higher.