Careful Planning Reduces Risk
Story and photo by Rodger Nichols
Risk is not just a board game. It’s a process managers must deal with. In the past, risk was often handled by putting up safety posters and buying insurance to mitigate any problems. But insurance is not nearly as helpful as prevention.
Among his many duties at Northern Wasco County PUD, Harvey Hall is in charge of enterprise risk management.
“We defined risk in a very simple way,” Harvey says. “Risk is the likelihood that actual outcomes will deviate from your expectations. That can be good—the upside—or it can be bad—the downside. The good thing could be things ran easier. There were no problems. Everything was aligned and the project was less expensive than you budgeted. Or it could end up being more complicated, like the typical bathroom remodel project that takes three times as long and costs twice as much as what you estimated because you keep running into more and more things.”
An enterprise risk management program typically manages the downside risk, Harvey says.
“You’re OK with the upside and we don’t want to inhibit the upside, but we want to manage the possibility that things don’t go as well,” he says.
Risk is a multidimensional affair, but Harvey doesn’t have to do this by himself. He oversees a team at the PUD.
Many people think of risk in terms of financial or physical risks, but Harvey says there are many types of potential risks can impede objectives.
“It could be a financial impact,” he says. “It could be an operational impact, which could be a financial impact where you lost money because a project didn’t go as planned. It could be an operational issue where we had a transformer failure or storm event— something went down, and it’s impacting operations. It could be a legal or regulatory risk. We could have safety issues.
“We could have HR risks where you have a key person in your operations who is no longer available due to illness or departure, or there could be a significant employee complaint. That’s really not been an issue here at the district, but you always have to be prepared and do things right so that event is less likely to occur.”
Harvey says most risk events carry a financial impact and an operational impact, but also what is called reputational risk.
“If an employee gets hurt at work, the first question is going to be ‘Well, how did that happen?’” Harvey says.
“Did everybody try to do the right thing? Were they in the right personal protective equipment? Did they follow policy and procedure on safety practices?”
The reputational risk becomes a concern when people don’t follow policy. Harvey says the PUD policy tries to ensure everyone returns home safely at the end of the day.
“If someone didn’t do the right things to protect employees and make it a safe environment and somebody does get hurt as a result, it becomes something on the front page of The Dalles Chronicle, and then it becomes a reputational damage to the district,” he says.
Harvey points out that managing risk is a question of balance.
“You can make things so risk-averse that you remove opportunities from the district to enjoy some of the upside of that risk,” he says.
Setting risk management policies starts with the PUD’s board of directors.
“They send the signals on the policy, and wewant to be operating within what the board sees as a comfortable tolerance for risk,” Harvey says. “We look at the types of risk. How comfortable is the board with financial risk? How comfortable are they with operational risk, safety risk or regulatory compliance risk?”
It’s not always easy, because as Harvey points out, risk is a fluid matter.
Financial risk tolerance, in particular, is influenced by circumstances. As in personal financial matters, those with a deep cushion of cash are more willing to risk some for a potentially higher return than someone living paycheck to paycheck who can’t absorb any losses.
Then there’s the case of utility rates. Harvey says utilities with high rates tend to avoid piling on another increase, which can be a large reputational risk. Because Northern Wasco County PUD has the third-lowest rates in the state, it can contemplate modest rate increases at appropriate intervals to keep from staying too low too long, which eventually requires sudden, large increases to catch up with costs.
Once the board sets risk policy, staff implements it. Harvey says that starts with constant communication with workers.
First is to make sure everyone understands the goals and objectives of managing risk in their work. Harvey says some people think of risk as just when something happens. He is careful to point out that managing risk is doing things before something happens.
“We’ve taken a lot of time at the executive team to walk through this policy,” he says. “What does it mean? How does it affect us? And what action should we be taking?”
It also means going out to staff and having departmental-level meetings.
“For the line staff, we have operations meetings at 7 a.m. every morning,” Harvey says. “Engineering and executive officers get together at 7 a.m. Monday mornings for a debrief on what has happened and what’s planned for the current week.”
Good enterprise risk management is about being aware, being prepared and having a plan. The PUD implemented the ERM program in 2019 and has been assessing risks across the company. The assessments help the PUD be aware of what risks it is facing, their likelihood of happening and their possible impact.
“A key part of this process is planning what we can do to minimize the probability of the event and its impact,” Harvey says. “The second part is having a plan in place on how to respond if the event does occur.”
With the recent COVID-19 coronavirus concerns, the district was prepared with a plan on how to respond if the virus occurred in The Dalles. As in other areas, the district is aware, prepared and has a plan.
