David Stark, senior vice president, practice leader enterprise risk and resilience, at Marsh Risk Consulting, examines risk in the airport industry and the best practices adopted by airport operators
The airport industry is an inherently high-risk sector, with passenger safety and asset damage at the top of most airports’ risk lists. Major airports are important components of national and international infrastructure networks, contributing considerable direct and indirect economic value. Recent air incidents have shown that the occurrence of significant threats can have catastrophic consequences to individuals, airport businesses, economies, and the wider aviation industry. Looking to the future, most major airports are undertaking significant business change projects (for instance, terminal and infrastructure development) within a live operational environment, which adds further complexity to the management of risk.
Operational risk management practices, such as safety management systems and emergency response, have been regulatory requirements for quite some time, with associated activities helping to ensure certain key risks remain tolerable and controlled, should they occur. However, these “givens” that are in place at all airports do not help manage strategic risks emanating from customer experience, growth, and competition, and only partially help protect shareholder value. Boards and management teams at leading airports are therefore starting to explore other risk management techniques to increase confidence in business outturn and address the gaps between standalone systems. These techniques are encapsulated under the umbrella term of enterprise risk management (ERM).
ERM considers all sources of risk (threats and opportunities) that may impact upon the business objectives and the management approaches required to control risks to tolerable levels. The implementation of ERM allows airports to help manage uncertainties and, therefore, provides confidence in the achievement of strategic goals and business objectives.
Taking the first element of the process, risk should be embedded into management activities and should not be an add-on, disbursed, or infrequent activity. ERM should not be bureaucratic – it should enable better decision making. Within an airport business, it is particularly important that the interfaces between management processes are identified and that ERM cuts across all areas, as airport businesses often display a tendency to conduct business and functional activities in isolation. Where risk exists, it will commonly have causes and implications across internal boundaries, thus necessitating a joined-up approach to optimize resources and effort for effective resolution.
The second element – people – recognizes the responsibilities and accountabilities of all parties in the risk management cycle of identify, assess, manage, review, and report. Of fundamental importance in the achievement of leading ERM practices is organizational culture, both within the airport business and within the supplier organizations responsible for providing services to the airport. Managers should understand their current culture and the actions required to close the gap with desired future culture. Only when the right culture is in place, will leading ERM practices be achieved.
Finally, information systems should be designed and deployed to record, report, and monitor the airport’s risk performance. Systems should be designed to suit the requirements of the airport’s management, not vice versa, and should interface in to other operational risk systems such as safety incident management, financial management and audit. The right risk management information systems improve management insight and the speed of response, and enable knowledge-based decision making, leading to improved business performance, customer service, and business growth.
Marsh Risk Consulting undertook a European Airports Risk Survey in 2014 to seek opinion and commentary from leading airport operators. The survey provided invaluable insight into the top strategic and operational risks, and the governance structures around their management.
Key findings from the survey include:
• Airports are managing operational risk well but express concern around enterprise risk maturity.
• More than 80% of respondents cited airport growth as the key driver informing their risk management focus.
• Only 18% of respondents feel that an ERM culture is completely embedded at their airport.
• The top strategic risk is the potential for a reduction in non-aeronautical revenue and the top operational risk is the possibility of a major incident at the airport or in the vicinity of the airport.
Embedding ERM will enable airport operators to increase their business-wide understanding of the sources of threats and opportunities, and the processes, people, and systems required to manage risk.
Furthermore, successful ERM implementation will lead to increased certainty over business performance, improved shareholder value, and public service provided airports.
June 4, 2015