Whom do the police call when a bank robbery goes awry and the thieves threaten to begin shooting hostages? Or when an angry political protest spirals out of control and degenerates into a full blown riot?
Beginning in Los Angeles in 1967, law enforcement agencies across the United States have turned to SWAT teams, paramilitary forces that utilize Special Weapons And Tactics to handle such crisis situations. Television shows, films, and other entertainment media have explored and even glamorized these modern cavalry officers who ride to the rescue when the going gets tough.
Wouldn’t American Gulf Coast residents have been thrilled to see a SWAT team of engineers and environmentalists ride in and manage the Deepwater oil spill when BP experienced its own disaster a few months ago? Four of the world’s largest energy producers finally announced the development of such a force last week …
… but why didn’t BP, or any of these other producers, foresee that a Rapid Response team would be needed?
One For The Valdez
Interestingly, after the Exxon Valdez oil tanker spill, the energy industry created the Marine Spill Response Corporation to serve as a SWAT team for similar tanker related disasters. Although the MSRC remains poised to manage another Valdez style catastrophe, the energy industry has (until now) declined to invest in the development of a companion team for deep sea drilling platforms in the Gulf of Mexico.
Why has it not done so? It would be easy to accuse the industry of gross negligence, or of foolishly under investing in safety practices in order to boost short term profits. And yet the costs of such rapid response teams are quite affordable when shared by multiple organizations; the new Gulf team, for instance, will be financed by Exxon Mobil, Chevron, Shell, and Conoco Phillips. And, of course, the benefits of maintaining these teams are self-evident during times of crisis.
So why wasn’t there a response team in place to serve the Gulf of Mexico? It is, in fact, entirely possible that the energy industry rationally assessed the situation and reasonably concluded that a comprehensive system of Enterprise Risk Management (ERM) simply didn’t require one. Until, of course, the Deepwater spill itself convinced industry executives to rewrite their ERM business plans.
Probabilities and Damage Estimates
How could such a conclusion be considered rational? Well, according to the COSO model of enterprise risk management, organizations must complete four distinct steps of analysis in order to address the risks of failure. First, they must anticipate potential crises before they occur through a process of scenario identification. Then, they must assess each crisis and prioritize the worst potential scenarios, focusing on the events that: (a) are relatively likely to occur, and/or (b) are relatively likely to cause extensive damage if they cannot be prevented.
Third, for potential crises with occurrence probabilities that exceed tolerable levels, organizations must invest in prevention controls that are designed to reduce these likelihoods. And fourth, for potential crises with damage estimates that exceed tolerable levels, they must develop rapid response mechanisms that are designed to reduce these costs.
These four core steps are labeled by COSO as event identification, risk assessment, control activities, and response activities. When ever an organization declines to invest in control or response activities, one rational explanation — other than gross negligence or sheer mismanagement — is that the firm simply underestimated the likelihood or damage levels associated with the crisis, or that the firm established a threshold level of tolerability that was too low.
Thinking Outside The Box
Although BP’s internal risk management plans are proprietary documents, the sheer volume of public information about the Deepwater crisis makes it feasible to speculate about BP’s investment decisions in the Gulf of Mexico. In fact, the most speculative aspects of their decisions likely involved damage levels; after all, unlike their estimates of the probabilities of failure — which were technical engineering estimates involving the reliability of the equipment itself — their estimates of damage levels should have encompassed both quantitative business costs and qualitative social costs.
It is relatively easy to identify and estimate quantitative business costs; the costs of repairing leaking pipelines, of removing spilled oil from the Gulf waters, and of cleaning up soiled beaches and marshlands are simply functions of the location of the crisis and the amount of oil spilled. But the qualitative costs of such a spill, such as the loss of the livelihoods of local business owners and the loss of a treasured way of life for an entire culture, require a significant degree of outside the box creative thinking. BP’s engineers and fiscal analysts may not have been comfortable with that type of task.
It is, in fact, reasonable to suspect that BP’s risk management plan simply didn’t address these qualitative costs at all, or perhaps it under stated them to a significant degree. If BP under estimated the damage estimates of such a crisis, it would then inevitably under estimate the need to invest in the relevant response capabilities.
Editorial Note: Our sincere “thanks” to Albert Blok, Clinical Research Coordinator at the Association of American Universities, for identifying an obsolete link regarding the Deepwater oil spill and providing a suitable replacement link. For more in-depth information regarding this topic, Albert recommends The Deepwater Horizon Oil Spill and its Aftermath and The Gulf Spill. He contributed to these resources … and we certainly agree with his recommendation.