Smooth Operator

July 2017

Oil & gas operations—from exploration and production to processing and refinement—carry many inherent risks. Key among these challenges are those related to supply, new technology, cybersecurity, business continuity and more.

Drilling Deep
Almost all oil & gas companies (98 percent) worry about general supply risks, which include expanding and replacing reserves, developing new drilling prospects, and accessing or acquiring production facilities. Similarly, 93 percent are concerned about their ability to properly recover undeveloped reserves or develop proved reserves. Due to the inherent uncertainty of calculating future prices and costs of production operations, making inaccurate reserve estimates is a key risk for 97 percent of oil & gas companies.

Half of oil & gas companies reference limited geographic drilling diversification as a risk to their business in the year ahead, up from 43 percent in 2016. Oversaturation in the Permian and Delaware Basins could be amplifying concerns around concentration of activity in select geographic areas, which can expose companies disproportionately to the impact of regional supply and demand factors, local governmental regulations and competition between energy companies. As turf wars for select land heat up, 83 percent of companies worry about a shortage in rigs, equipment and personnel.

Under Construction: Energy Infrastructure Still the X Factor
As a part of the new administration’s broader aim to strengthen the nation’s energy infrastructure, the president issued executive orders in January removing roadblocks to the Keystone XL and Dakota Access pipelines. Despite movement on pipeline construction and a proposed $200 billion increase to federal infrastructure investment in the White House’s 2018 budget plan, nearly 9 in 10 companies (89 percent) still report insufficient refining, pipeline, storage or trucking capacity as a risk.

While a boost to federal infrastructure spending and incentives for private investment could lessen this threat in the long-term, tangible improvements to energy infrastructure likely won’t come to fruition for years to come. In a similar vein, reliance on third party-owned processing facilities and transportation is also a concern, identified by 85 percent of oil & gas companies. 


For Oil & Gas, the Future Looks Digital
It’s the age of Industry 4.0, where the cyber and physical worlds seamlessly intersect, and oil & gas companies are enlisting in the movement. The industry started to embrace automation, the Internet of Things and other technology developments during the global downturn, recognizing the potential to increase efficiency, cost-effectiveness, responsiveness and safety through operational excellence and data-driven decision-making. Even as prices have edged slightly higher, the top oil & gas companies remain committed to technology-driven operational improvements and strategic investments in the future of energy production. This June, BP inked a deal to invest in an artificial intelligence (AI) startup, and Pioneer Natural Resources announced plans to use AI in their drilling operations.

While new technology carries the potential to streamline, expedite and enhance operations, the oil & gas industry is likely to experience growing pains as changes take hold. More than two-thirds (69 percent) report technological advances affecting energy production, consumption and supply as a risk, up from 60 percent last year. Competition could be another factor driving concerns around technological advancements. As energy giants accelerate investments in new operational technology, slower adopters could be left behind in the innovation arms race.

In the face of this industry disruption, energy jobs—and the skillsets they require—are evolving. Skilled workers with more specialized, technological expertise are quickly becoming a more valuable commodity. Seventy percent of oil & gas companies in the study cite a shortage of skilled personnel as a concern, up from 65 percent last year, and another three-quarters of oil & gas companies worry about their ability to attract and retain key personnel, up 10 percentage points from 2016.


Beware the Cyber Plateau 
With the adoption of automation and smart production processes comes more attack vectors for bad actors. The oil & gas industry has come a long way since 2012, when just 12 percent of companies reported cyber risk in their 10-Ks, but many are still underestimating its impact. After a steep climb to 72 percent in 2015, the percentage of companies citing cybersecurity concerns has plateaued at 73 percent this year.

In this report’s history, cyber risk has never appeared in the top 20, yet it has become of increasing national concern. The energy industry is particularly vulnerable to cyberattacks due to the large geographic distance that many oil & gas companies cover, with numerous access points spread across their production, transport, storage and distribution infrastructure. The vulnerability of oil & gas companies is further exacerbated by the need to protect not only their traditional IT infrastructure, but also their Industrial Control Systems (ICS) infrastructure and the many internet-enabled instruments and devices they employ.

Strengthening the cybersecurity of critical infrastructure, which includes oil and natural gas pipelines, has been the subject of federal attention several times already this year as state-sponsored attacks have ramped up. In early March, the Department of Homeland Security (DHS) issued a cybersecurity alert for critical infrastructure owners and operators to outline the key threats. President Trump signed a long-awaited cybersecurity executive order in May that focuses on strengthening federal cybersecurity networks and critical infrastructure.  


“When it comes to cybersecurity, oil & gas companies can’t afford to let their guards down. Virtually any company operating in the energy industry can, and likely will be, targeted by hackers with a wide range of motivations and levels of sophistication, as energy is one of the primary targets of cyber warfare. Developing a comprehensive risk-based cybersecurity program is crucial to energy resilience.”     

2017-Oil-Gas-RFR-headshots_Chuang.jpg  Eric Chuang
  Head of the Cybersecurity Incident Response team and managing director in the Forensic Technology Services practice

The cyber landscape and the nature and severity of cyberattacks has certainly evolved over the last two years, suggesting that oil & gas companies still have much to do to ensure they are cyber-ready with the proper internal controls, detection capabilities and mitigation strategies in place.

Moving Full Speed Ahead
In addition to cyber threats, oil & gas companies are susceptible to a wide array of business continuity risks, ranging from natural disasters to human error. Unanimously cited as a risk to operations, natural disasters and unexpected weather conditions could wreak havoc on offshore drilling and production facilities or coastal refining plants. In the event of a hurricane, earthquake or other severe weather, a well-developed disaster preparedness and business continuity plan is key to minimizing damage and disruption. 


Ninety-six percent of companies point to operational and E&P risks, which encompass spills, blowouts and equipment shortages or delays, as well as personal injury or loss of life. With an acute understanding of the risks at hand, about two-thirds of oil & gas companies (66 percent) are concerned about litigation and other legal proceedings, an increase from 43 percent in 2016. Ninety-three percent also worry that these liabilities may not be fully covered by their current insurance policies, up 10 percentage points from last year.