June 2007 Capital Adequacy Extension © Copyright 2007, CCRO. All rights reserved. Page 40 of 92 infrastructure to mitigate that risk must be estimated to determine capital requirements. In determining the potential operational loss, companies can subjectively determine where the greatest risk resides based on their knowledge of the business and then tie the process to accounts on the financial statements to make an assessment of the potential severity. Based on the knowledge of the business and the process’ assessed potential impact on the financial statement account, risk personnel can make a reasonable assessment of where controls and oversight should be concentrated. In many cases this approach can be more effective than applying complex quantitative models in determining potential operational loss events however it does require a complete audit of people, processes, and systems, which is why it is advisable to work closely with business personnel with in-depth knowledge of their operations when conducting this risk assessment. 4.7. Operations: Measurement of Physical Risks and External Risks Measuring potential loss due to risks that reside within the physical risks from production, delivery, and storage of energy commodities and external risks from legal, regulatory, political, and environmental exposures will usually be a done on a case-by- case basis. This is because, even within this category, the risks can be diverse enough to require an individual approach. Recall from PRINCIPLE 4 that it was recommended to work with the business personnel (Engineers, Legal, Compliance, etc.) in identifying potential operative risks in this area. Once those risks have been identified, the analysis should focus on the probability of those events happening and their potential severity, which can also be ascertained through a collaborative effort with these business personnel and others who have knowledge of the physical, legal, and regulatory risks surrounding energy commodities. Armed with the knowledge of potential events and their probabilities, one can measure what the financial impact is should those events occur. This will entail scenario analysis and creative measurement solutions that will span the spectrum of qualitative and quantitative techniques, depending on the type of risk being measured. One important aspect to note is the relationship between Operative and Market risk. Some companies incorporate the physical infrastructure aspect of operations into market risk analysis. As an example, utility companies can have a model that looks at a probability analysis of their generating plants going down under different operating conditions and many of these conditions are prevalent during high prices. Simulating plant outages during high prices and measuring the risk incorporates both market and operations risk. Whatever method of measurement is chosen (qualitative, quantitative, or a combination of both) management must ensure that the methodology is reasonable and the assumptions are transparent to outside constituents. Rating agencies, analysts, or investors should be able to understand the measurement approach and comprehend the action taken as a result (disclosure will be discussed later in this chapter). This paper will not go into specific measurement techniques, as each company faces its own distinct operative risks and no one paper can cover all possible approaches. However, Figure 4.3 displays graphically the various approaches