Introduction

Background and purpose

The project concerned the potential acquisition by an international oil company (IOC) of a 50% interest from an international energy company (IEC) of its 50% economic interest in Oil Development Company (ODC), giving it a 25% economic interest in ODC. ODC was a holding company located in a developing country (Figure 1). ODC controlled a number of operating companies with upstream oil and gas exploration and production (E&P) assets.

ODC was a mid-range company with a forward plan aimed at substantial growth. It planned to increase its oil and gas output from its existing upstream assets. It also planned to become an integrated oil company by acquiring downstream assets, including refineries.

IEC wanted to divest part of its equity interest in ODC so it could reduce its exposure to the country and diversify its portfolio of investments. For IOC, the acquisition of a share of IEC’s interest in ODC would provide a strategic foothold in a new and potentially important location.

Broadleaf was asked to assist IOC in assessing the opportunities and threats associated with the acquisition, to contribute to IOC’s due diligence, submissions and approvals process. There was a specific objective of generating input for an imminent meeting of the Executive Committee (ExCo).

The focus did not include operational opportunities and threats unless they were important for this stage of the process. They would be examined in later, more detailed assessments, but only after the ExCo had given approval to proceed to the next stage.

Risk assessment

Risk assessment process

The assessment process followed the IOC’s enterprise risk management framework, which was compatible with ISO 31000. The risk analysis used the company's analysis and evaluation scales, with the financial scales adjusted to reflect IOC’s potential shareholding in the new entity.

Establishing the context

The context and business environment in which the acquisition would take place were examined in detail. In particular, a comprehensive project framing exercise was conducted as a brainstorming activity with the project team.

The outcomes from the framing workshop were a structured list of facts, uncertainties and decisions that defined the problem for IOC, a clear opportunity statement and a specification of what success would look like (Figure 2).

Key elements

The key elements in Table 1 provided the basic structure for the brainstorming activities to identify opportunities and threats in the workshop. They were intended as a guide for brainstorming only, not a formal classification of strategic issues.

Initial risk identification

Several lists of opportunities and threats had been generated as part of initial project framing and due diligence processes. These were consolidated and amalgamated into an initial opportunity and threat register by:

• Omitting items that were clearly not relevant at this stage of the project
• Combining items that, together, seemed to be important for the approval process
• Grouping items into the key element structure in Table 1.

This consolidated register was used as the starting point for opportunity and threat identification in the workshop.

Risk assessment workshop

Risk assessment was undertaken in a facilitated workshop with 20 members of the project team and its external advisors. Collectively, they had expertise in all the key elements in Table 1.

The workshop involved brainstorming, with two passes. In the first pass, for each key element, participants:

• Briefly reviewed the area covered by the element, to ensure everyone was using a common set of definitions and assumptions, and reviewed the opportunities and threats that had been identified already
• Identified the most significant potential opportunities and threats that might impact on the element
• Noted existing controls relating to each opportunity and threat, and rated the control effectiveness
• Assigned consequence and likelihood ratings, given the controls
• Established initial risk ratings
• Assigned potential exposure ratings, the maximum consequences for the company were all the controls to fail
• Assigned responsibilities for each opportunity and threat.

In the second pass, participants reviewed and confirmed the risk rating for each opportunity and threat.

The outcomes were reviewed after the workshop and initial management responsibilities were allocated for each opportunity and threat. Some reclassification of opportunities and threats into more appropriate key elements also took place.

Risk assessment outcomes

The main outcome from the assessment workshop was a list of key opportunities and threats for the project, with agreed priorities and responsibilities for avoiding or controlling the threats and capturing and exploiting the opportunities. Some operational opportunities and threats that were not relevant to the ExCo approval decision were removed from the outcomes, but they were recorded and maintained for inclusion in the register for subsequent stages of the project.

There were 64 risks (Figure 3), of which eight were opportunities and 52 were threats. Six of the opportunities were related to ODC’s existing business, and two were related to commercial matters.

The register showed the opportunities and threats as they were on the day of the workshop, given the effectiveness of the controls at that time. At this early stage of the due diligence process there were few controls in place, although many were planned, and the high numbers of high-priority items reflected the absence of controls. As due diligence progressed, many of the priorities were expected to reduce.

There were seven risks with Priority 1 that were fundamental to the approval decision.

• Two risks were safety matters associated with current and future operations, due to the large workforce and the potential for the growth path of the company to involve acquisition of downstream businesses involving operations and assets with which the company was not familiar
• Three risks were related to the strategic direction and control of the business: the capability of ODC to grow at the projected rate and still maintain management control, IOC’s ability to control the business effectively and IOC’s ability to exit the business should this become necessary
• IOC’s lack of specific country capabilities and experience would be a major limitation on due diligence for this acquisition, and would restrict the company in the future
• More generally, this acquisition might restrict IOC’s ability to undertake further major business activities in the country.

There were 22 risks with Priority 2, relating to:

• The acquisition and due diligence process
• The reserves that would be acquired
• Control over the business
• Country risk
• HSEC matters
• Failure to capture the growth anticipated from the business.

The outcomes were important for the project team, both to inform the submission to the ExCo and to structure the due diligence process.

Lessons

Opportunities and threats

Not many opportunities were identified. It was recognised that the proposed acquisition offered opportunities for the company, but there were many threats associated with it, and with the country where it was located.

The focus of participants in the workshop was often on potential fatal flaws for discussion at the ExCo meeting. This is common at very early project stages – there is a concentration on potential deal breakers, because unless they can be addressed and eliminated then other analysis is irrelevant.

Input to next stages of the project

While this assessment was focussed on generating information for the ExCo, other opportunities and threats were identified during the process. These were not relevant for ExCo at this stage of the project, but they would be relevant for future stages.

It is good practice to retain risks that apply to future stages of a project, as inputs to later assessments when those stages are reached. All ideas should be recorded where it makes sense to do so.

Guide to due diligence activities

The initial framing stage generated valuable information in its own right. Its main purpose though was to establish a clear foundation for the risk assessment and ensure that this was efficient and comprehensive.

The risk register identified those parts of the acquisition where there was greatest uncertainty, often because the controls had not been examined in much detail. The risk priorities thus set the short-term priorities for the team’s due diligence and control development activities that would reduce uncertainty.

We have often used risk assessments to help teams set work priorities as their projects move through approval tollgates (or stage gates) towards final investment decisions. Much of the effort at any of the early stages of a project is devoted to reducing uncertainty to what the company believes is a tolerable level. The risk assessment is an excellent tool for this.