Murray & Roberts is a leading engineering and construction services company in South Africa and is recognised as an international engineering and construction group. It provides civil, mechanical, electrical, mining and process engineering, general building, procurement, construction, commissioning, operations and maintenance services. Murray & Roberts covers the global underground market, selected international oil and gas markets, selected African power and industrial markets and selected African infrastructure sectors.
The engineering and construction industry faces various high risk scenarios, including a combination of negative markets, protracted strike action with labour unions unable to reach settlements amicably, loss of life due to poor safety standards, and delays and cost-overruns on major projects. If these risks are not understood and managed, stakeholders could face significant losses.
Most organisations in the industry undertake some form of ERM, based on best practices such as the ISO31000 framework. However, many still only take a qualitative approach. This is for a variety of reasons including a lack of the required level of technical knowledge, the belief that intuition provides adequate insight, and a tendency to avoid complex mathematical issues.
To combat this, Murray & Roberts is evaluating a more quantitative approach that links risk exposures to company value by way of cash flows.
Simulating risks with @RISK
Murray & Roberts uses enterprise discounted cash flow (DCF) and discounted economic profit (EVA) as the valuation technique for company value. This measurement approach was selected as it relies exclusively on the flow of cash in and out of the organisation, the method preferred by investment houses and analysts, rather than on accounting-based contributions.
The risk problem is simulated using @RISK, which allows the simulation to be adjusted to account for interdependencies and correlations between risks.
The risks that are relevant to the business in question are first identified. These include threats and opportunities because the risk management process is highly effective at handling the upside of risk as well as the downside. Using the top eight risks faced by the business (where seven are threats and one is an opportunity), Murray & Roberts prepares a correlation matrix. This identifies quantifiable relationships between threats and opportunities, i.e. if one threat occurs, there might be an increased probability of another also materialising.
The results are input into @RISK to determine the impact on the baseline value of the company for each risk. This is undertaken for inherent risk (the maximum risk exposure before considering current controls) and for residual risk (the risk remaining after current controls). For Murray and Roberts, current controls include tactics such as the development of more robust strategies to enter northern Africa and consulting with blue collar workers directly to avoid the increased threat of strike action.
Inherent risk: @RISK graph showing outputs of individual risk simulation results
The above graph shows the impact on the organisation's cash flow of each individual risk, should it materialise. The percentages exclude the effect of any controls the organisation has in place to mitigate the likelihood of the events occuring.
Residual risk: @RISK graph showing outputs of individual risk simulation results
This graph shows the impact on the organisation’s cash flow of each individual risk, should it materialise, taking into account any controls the organisation has in place to reduce the probably of them doing so. The values are lower that those for inherent risk, indicating that the controls are effective.
The total impact of inherent risks and the total impact of residual risks are then calculated by ‘shocking’ the baseline company value. This ascertains the effect that all the risks combined could have on the company’s baseline cash value.
Various ‘what-if’ scenarios were tested, such as adding additional threats should the business decide to enter the South American markets, or diversify its construction activities to include water projects. The results show the impact of correlated risks before and after considering current controls.
@RISK’s binomial distribution is used to determine if the risk occurred or not and therefore whether its impact on cash flow needs to be included in the rest of the simulation.
Subject matter experts provide input on each of the risks in terms of how likely they are to happen and the best, worst and most likely case scenarios, should each occur. These experts are as independent as possible from the issue in hand and are drawn from across the business; the HR, engineering, strategy teams for example.
@RISK’s PERT distribution is used in a simulation to generate a cash flow impact based on the restrictions of the minimum, most likely (mean) and maximum inputs.
Running the @RISK simulation shows what impact the top eight risks would have on the baseline company value if no current controls were executed. This graph shows the impact of pure risk on the company (before any controls have been implemented). It indicates that the cash flow is most likely to be 12.6 billion Rand. This will be negative (5.1 billion Rand) in a worst-case scenario, but rise to 20.7 billion Rand in a best case scenario; ie if the fewest possible risks happen.
The next step models the baseline company value taking into account the impact of the current mitigating controls on the top eight risks. In this case, the cash flow increases to 13.6 billion Rand, the worst-case scenario sees this drop to 4.6 billion Rand, while the best case is 20 billion Rand.
Sensitivity analysis is then undertaken to identify which risks posed the greatest variability on company value, both for inherent and residual risks.
Sensitivity analysis by inherent risk
With no controls in place, risks 1, 2 and 6 occuring will have the greatest impact on cash flow.
Sensitivity analysis by residual risk
Implementing controls significantly reduces the impact of risk 2.
The risks can be analysed further in order that strategies can be designed and implemented to reduce the chance of them occurring and the impact if they do so (or increase the probability and impact in the case of opportunities). Sean de la Rosa, project and enterprise risk manager of the Power & Water Platform at Murray & Roberts, says: “@RISK offers the powerful simulation capability that is required to model complex risk problems. Despite this, the simulations are relatively easy to perform and require minimal in-depth mathematical expertise.”
Murray & Roberts
Most useful software features:
- Ease of use
- Ability to run ‘what-if’ scenarios quickly
- Ability to graphically see the various simulation distributions generated
- Caters for increased complexity in modelling if the need arises
- All output is Excel based and can be easily transferred to Microsoft based reports
In addition, Palisade provided one day of consultancy, which enabled Murray & Roberts to benefit from an expert reviewing and advising on its models.
Distributions used
Binomial: This distribution allows for the simulation to choose between a ’0’ and ‘1’ option. If ‘0’ is selected, this means that the risk did not materialise. In the case of a ‘1’ being selected, the simulation would record the risk as having happened and would then include the impact this has on cash flow impact into the rest of the simulation.
PERT (Program evaluation and review technique): A form of Beta distribution that is widely used for modelling expert estimates where one is given minimum, most likely and maximum guesses.