Philip Osmond, British Airways

Expect the unexpected, British Airways’ risk leaders say, and be prepared to deal with the consequences – which probably means having deep enough pockets to manage your way out of a crisis.

Talking to StrategicRISK at the airline’s Heathrow headquarters, risk and internal control boss Philip Osmond explains: “You can put all sorts of controls in place to mitigate what you know about, but there are often risks that you simply don’t know about.”

This was the challenge BA faced in April, when a huge ash cloud spewed out of Iceland’s Eyjafjallajkull volcano and air safety authorities imposed a blanket ban on flights in northern European airspace.

It was an “understandable overreaction”, says Osmond. But what helped BA get through the crisis – albeit not completely unscathed – was that it had decent plans in place to deal with disruption, even if it hadn’t anticipated that particular scenario.

“The result of it was a stopped operation,” admits Osmond, “which could also happen from a massive IT failure, a massive power failure at Heathrow, fuel disruption or flooding. Sometimes you can’t stop the event, so you have to put procedures in place to deal with the effects of that event.”

This business resiliency is critical for an airline, he says, because running a fleet of aircraft is hugely complex and many activities are inter-related.

“A BA aircraft takes off or lands somewhere in the world on average every few minutes, 24 hours a day, every day of the year. That’s complicated. Things go wrong. So you start with the premise that you expect things to go wrong. That’s part of the risk of running an airline. It’s part of the risk of running any business.”

Sammut adds: “Disruption is inevitable in any business. The key thing is that you prepare for it when it happens.”

“And the chances are you won’t be able to stop what it is. What you have to do is to be prepared for it. And part of that risk mitigation is as simple as having the cash,” adds Osmond.

Terrorism is another big risk facing the airline industry. It’s an unlikely one, but it can’t be ruled out – no matter how many precautions are put in place to stop bombers stepping onto a plane and blowing up the aircraft and everyone in it. October’s printer cartridge bomb plot is the latest example. Bombs concealed in printer toner cartridges were discovered on separate planes bound for synagogues in the USA from Yemen.

“You have obscure factors to contend with in this industry that many others would not have to face,” Osmond says. “We go from having to think about what a terrorist might do next through to what happens when part of an engine doesn’t do what it’s supposed to – as in the Sydney-bound Qantas A380 incident.”

Career path

These are just a few of the challenges he has had to contend with since joining BA three years ago. After a successful career in finance, Osmond received a call from BA chief financial officer Keith Williams in 2007. He recalls: “Keith said: ‘Willie Walsh [BA chief executive] and I wondered whether you might like to talk to us about an opportunity we have here.’ I thought it was one of my mates pulling my leg, to be honest. I came in at 7.30am on a Monday morning and walked out at 9am with a job.”

One of his first tasks was to overhaul BA’s “old fashioned” approach to risk management and install a top-down strategic approach to overlay and complement the bottom-up, operational system. In real terms, it meant integrating risk with the overall assurance and audit programmes.

Among other things, the change meant that rather than auditing airports on a cyclical basis every four years, no matter what their risk profile, BA could take a risk-based approach to its audits. This would focus on the sites, or risks, that represented the biggest exposure or threat to critical business operations.

The system Osmond and his team installed looks across the whole risk spectrum – anything from the strategic risk of Heathrow’s third runway not being built to the operational “iceberg risks” around terrorism and air incidents.

“We started the whole process with some honest discussions with our leadership team, with Willie and his directors,” Osmond says.

“We asked them the simple question of what keeps them awake at night.”

After implementing the system, he benchmarked BA against peers such as Samsung, John Lewis and Barclays. “The bit that was missing for me was that we didn’t really have that view of risk appetite. We didn’t therefore have the view of which controls were the most important ones,” Osmond says. “We have a huge amount of control over our operations at Heathrow, for example, but less so over the catering operations down route, particularly in certain destinations.”

So rather than treating all of the sites in the same way, Osmond is now able to prioritise controls so that high-risk “down route” locations have the appropriate risk and assurance resources allocated to them. “You’re never going to eliminate all risk, but you’ll do more to eliminate certain risks than others,” he says.

Crew safety

Another area that Osmond has paid particular attention to is crew safety. “We are going through a lot of the hotspots at the moment – the places we think the greatest risks are to our crew when they are down route for several days.”

Sammut, also an accountant by trade, joined BA five years ago from Qantas. As well as helping the team with the risk and assurance frameworks, he is also responsible for BA’s anti-bribery programme – particularly important now that the new Bribery Act is significantly toughening the UK’s stance, says Sammut. “We have put together a programme, which will take two years to implement.

“For BA, it is serious because we operate in high-risk parts of the world such as West Africa, the Middle East, Asia and the Far East. So it presents a risk for us, particularly when we do a deal in parts of the world where the culture thinks [bribery] is normal practice.”

Despite all this good work, the complexity of the airline business means things can and do still go wrong. Sammut says: “Moving aircraft around the world in large numbers on a regular basis is not easy to do. It only takes one small thing to go wrong and you can’t move the metal around.”

Take BA’s flagship Terminal 5, which opened in March 2008. Despite the fact that the construction project was delivered on time and within budget, it was overshadowed by a relatively simple error with the baggage-handling system and data from transfer fl ights. It caused 48 hours of chaos when the airport opened.

“Unfortunately, the press love a bad story,” says Osmond. And this bad story, coupled with the travel disruption it caused, seriously tarnished BA’s reputation.

“We go back to the fact that things go wrong,” he adds. “You can understand this if you go downstairs into the baggage-handling area of Terminal 5 and see the complexity of it – we handle 30 million-odd bags a year and every single one goes from one place to another in a 15-minute window on a baggage belt.”

Given this complexity, and the fact that most passengers take off and land with their baggage intact, it’s easy to sympathise with the view of some in the airline industry that passengers’ expectations can be unreasonable.

So do many other businesses start, like BA, with the premise that things will go wrong? In Osmond’s opinion they do not. “I don’t think they start with that simple view. The fact is that there are risks in your business. If there aren’t any risks at all, you’re probably not going to make any money, because risk is opportunity.”

Sammut agrees. “In the airline industry, we constantly have shocks, so we are constantly expecting the worst. In some industries, such as financial services, they don’t expect the worst; they have a bump maybe every 50 years.

“We have a bump every three or four years, so the mindset is to always think worst-case scenario – other industries aren’t like that.”

That’s a fact that risk managers at ground level may want to consider.