Introducing Scenario Based Audit – A Risk Based Approach to Auditing
Authors: Ganguly Ranjana , Al-Faraj Mohammed , Hancock Gretchen 
Published: February 2017

Abstract

Objectives/Scope
The objective of this paper is to share GE's story of how it is maximizing the value of its governance and oversight programs through the innovative use of a technique known as scenario-based auditing (SBA) and translating the outcomes and learnings into the larger context of overall risk management.

Methods, Procedures, Process
Most audits start by looking at an operation as it exists. However, SBA starts from a different place – a real hazard, and a hypothetical but plausible event that releases that hazard. The purpose of the audit is to evaluate the extent to which protections designed to safeguard against the hazard are truly in place.
The audit scope is determined by selecting "scenarios" or undesirable EHS incidents related to hazards or hazardous activities relevant to the operation. The audit team then uses the bowtie methodology and facilitation to map out the conditions that could lead to the incident. The team also identifies defenses (controls) which should be in place to prevent the incident from occurring or to mitigate the consequences. Defenses are tested by the team to ensure they are in-place and functional. Impaired defenses are taken up for strengthening through an action plan.

Results, Observations, Conclusions
Since the start of its use in 2014, we have seen great results with this approach. For example, in our Oil & Gas business where pressure testing is a high-risk activity we got some highly valuable insights. As a result, 20% of all governance audits in 2015 were SBA.
Being a deep, qualitative and team-based approach, SBA has several benefits when used in the right context. Its success is primarily attributable to two factors – proper scenario selection and audit team composition. From our experience we have found that high-consequence scenarios generate great insights. A cross-functional team is very important. In an SBA, the employees that work with the hazard every day are a critical part of the audit team. This collaborative environment provides a particularly good forum for employees to voice concerns about how the next significant event could happen, and highlights for other audit team members the importance of teamwork and risk reduction.
Encouraged by team feedback and insights we are now extending the use of scenario-based approach to risk-reduction workouts as well as event/ accident investigation.

Novel/Additive Information
Based on the encouraging results and the great feedback in GE we highly recommend SBA - only an incremental step for the petroleum industry already using tools like bowtie extensively. After all, when governance programs go beyond simple oversight to actively address potential problems… when we connect the dots between seemingly disparate situations to highlight emergent risks, we change the game.

Manuscript

Background
As the global economic environment becomes increasingly volatile and competitive, leaders are looking for ways to derive additional value from traditional programs. Business models such as Zipcar, Uber, and AirB&B are cannibalizing long-standing industries; leaders expect that level of innovation. Rightfully so; we no longer live in a world where oversight of regulatory expectations alone can be the only reason for compelling the level of resource required to run a governance program in a company the size of GE. Innovation and controllership may seem strange bedfellows, but the ever-increasing availability of information, combined with a spirit of collaboration in horizontal organizations, is creating a step-change improvement in corporate governance by illuminating hidden system weaknesses and catalyzing a team approach to problem-solving.
Listening to the next generation is a great way to push leadership thinking beyond what exists today into what could be possible. And in 2010, a group of emerging EHS leaders created a compelling case for a new model for governance and EHS auditing at GE. So, as we redeployed to a globally-networked, shared service model for EHS service delivery, we also established a governance model that has the scale to deliver outcomes at the facility level, network those impacts across a region and a business, innovate new approaches, and derive insights for business leaders about the health of their programs globally.
But six years – from 2010-2016 – is a lifetime given the pace of innovation. Over that time man-made and natural disasters – from Macondo to Hurricane Sandy – have focused EHS professionals on our obligations not only to comply, but to reduce both the probability and consequence of high-hazard events. As GE embarked on its new EHS service delivery model in 2014, the new globally-linked network of EHS governance experts gave us a platform to experiment with a way to get additional value – to identify & mitigate risk – using our long-standing compliance & management systems auditing programs.
The objective of this paper is to share the story of how scenario-based auditing has transformed the way the company conducts EHS governance activities, and offer some ideas about how other entities may consider implementing such a process to enhance EHS-related risk management.