A softer landing

A company takes a risk, a big risk, when it makes an acquisition. Buying another business is as likely to destroy shareholder value as to enhance it. The collective board room hearts of the Spanish infrastructure company Ferrovial must have sunk on 10 August 2006 as chaos descended on the airports owned and operated by its newly acquired subsidiary, British Airports Authority (BAA). It was not, BAA chief executive Stephen Nelson admitted, UK aviation's finest hour.

Less than two months previously Ferrovial had led an international consortium in the acquisition of BAA for £12bn. Ferrovial took control of the BAA board on 26 June. Shortly after, the Office of Fair Trading (OFT) announced an investigation into the UK airports market that could eventually lead to a demand for the break-up of the BAA London airports monopoly.

On 10 August, faced with a terrorist threat to blow up aircraft using liquid explosives, the UK Department for Transport issued new security instructions. BAA put them into effect at the seven UK airports which it operates, including Heathrow, the busiest international airport in the world, Gatwick and Stansted.

There were significant but inconsistent restrictions in airports worldwide. In the UK, hand luggage was very restricted and all passengers had to be hand searched, and their footwear screened. Any liquids discovered were removed. As BAA itself described the situation, "BAA was grappling with constantly shifting security rules and an unprecedented logistical logjam, while fending off criticism from all-comers. Cue congestion, confusion and teeth grinding delays. And a website crashing under the sheer weight of enquiries."

The leader in the Financial Times on 15 August summed up the thoughts of many, 'Anyone arriving at Heathrow could have been forgiven for concluding that the terrorists had already blown up a few aeroplanes over the Atlantic. Contingency plans should have prepared BAA to take tighter restrictions in its stride.'

The same day, BAA countered, 'For the avoidance of doubt, BAA operates detailed contingency plans for many types of emergency, and crisis management teams are routinely staffed jointly by airports and airlines. However, the scale and suddenness of the measures imposed last week could not be managed without significant disruption. No organisation can hold sufficient staff in reserve against such a significant and sustained increase of activity.'

Just before Christmas 2006, several days of dense fog reduced the number of take-offs and landings at Heathrow and resulted in the cancellation of many European services. There were complaints, but not to the same extent as in August, perhaps because long haul flights were less affected, and many people were able to make alternative, if less convenient, arrangements.

Ferrovial has a 62% stake in BAA, while the other consortium members, Canadian investment group Caisse des Depot and the Singapore government's investment firm GIC, have 28% and 10% respectively. BAA is an important element of Ferrovial's infrastructure and services businesses, which after full integration of BAA will be responsible for 60% of Ferrovial's revenues and 85% of its earnings before interest, tax, depreciation and amortisation (EBITDA).

In the immediate aftermath of the 10 August security alert, Ferrovial's shares dropped from EUR62.25 on 9 August to EUR57.50 on 19 September and underperformed the Spanish IBEX 35 index of which they are component. It was, however, only a hiccough. Having previously rallied from a low of EUR51.75 on 16 June 2006, Ferrovial's shares resumed an upward trend and by the end of January 2007 stood around EUR75.00. Analysts expect the upward trend to continue.

No acceptable level of accidents

BAA manages seven airports in the UK, including all three major London airports, and has acquired 75% of Budapest airport. Unfortunately, the company did not respond to our questions, but the weight of information about its risk management programme counters the criticism that followed the security alert in August. Its most recent annual report, for the year 2005-6, gives evidence of a systematic and well integrated risk management programme.

The construction of Heathrow Terminal 5 brings the story to life. The new terminal is being built over five years at a total cost of £4.3bn. Twenty major companies are involved, with probably 2,000 suppliers and 60,000 workers.

Speaking at a conference at the Institution of Civil Engineers in June 2006, Mike Evans, head of Health, Safety and Environment for the T5 project, explained that on the basis of industry statistics, BAA could have expected at least two deaths and 600 serious injuries during the construction. This was unacceptable to the BAA directors, he said, and they rejected the idea that an incremental improvement was good enough. There was, in fact, "no acceptable level of accidents," Evans said. Instead, T5 would create an incident and injury free culture.

This change was wide ranging, starting with commitment from the top, getting engagement from suppliers, creating integrated project teams, re-engineering processes if necessary, defining competence standards and providing excellent occupation health and welfare facilities.

Evans said that as senior management showed leadership in talking to people about safety, the workforce felt able to talk to their managers and each other about it.

At the end of 2006, with opening scheduled for a little more than a year away at 4 am on March 2008, T5 has not only succeeded in its health and safety objectives, it is also on time and on budget.

Corporate governance regimes frequently require directors to give assurance to shareholders that they have a risk management strategy. Most companies comply with a bromide statement. BAA by contrast set out its policy and programme in a two page risk management report in 2005/6. It says, 'The vision of risk management is to embed the awareness of risk at all levels of the organisation in such a way that every business decision is risk-informed.'

Further, the company explains that a key element of the process is its risk profiling methodology, which determines the threats to the achievement of its business objectives in terms of probability and severity after taking controls and mitigating measures into account. Details are maintained in a hierarchy of risk registers which form the basis of a regular review by the executive committee.

Unusually, BAA sets out the risks by groups - safety and security; regulatory, environment, legal and reputational risks; and commercial and financial. Commercial and finance risks are further broken down into capital projects, the success of the delivering excellence change programme, industrial relations and the usual financial risks that any large business has.

New parent

From its origins as a construction company in 1952, Ferrovial has become one of the world's leading infrastructure groups, with a capitalisation of more than EUR10bn and over 100,000 employees. It is, if anything, even more explicit than BAA in its reporting on risk management. In its annual report for 2005, the company sets out its risk policy and the risks covered by the system, a diagram of its control systems, the results of its risk management strategy, the corporate functions with responsibility for risk management and its compliance process. The most significant groups are listed as:

- Risks related to deficiencies or delays in executing work or providing services

- Environmental risks

- Financial risks

- Damage resulting either in liability to third parties or damage to infrastructure Ferrovial owns or manages, primarily due to natural disasters.

It also explains that its procedures are based on the risk management standard originally developed in the UK. The information that the system uses is generated through a small team that includes the heads of the finance, quality and environment, human resources and legal departments directly supervised by the general manager of the corresponding areas.

The risks are assessed and prioritised by a standard, semi-qualitative procedure based on a system of relevant, reliable indicators that in each case describes the control and management measures established. This information is periodically compiled and cross-checked before being sent to the audit committee.

For the 2005 year, Ferrovial reported that there were no risks other than those resulting from the normal conduct of its activities that had a significant adverse effect on the business. 'In fact, when there has been a situation in which a risk could materialise, the prevention, information and control systems worked effectively. Therefore, the company believes that its risk management systems and resources have worked satisfactorily." This is not to say that a well considered enterprise risk management system makes risks go away, even though, with BAA part of a large multinational group, the travelling public is increasingly likely to see reputation linked to individual airports rather than their owners. Public sentiment can, however, feed through to legislators, while airport customers, such as the airlines, have their own commercial interests.

Among the risks that Ferrovial and BAA have to manage is pressure for break up of BAA's dominant position in the ownership of the UK airports. In December 2006, the OFT called for a detailed investigation by the Competition Commission into the supply of airport services. BAA defends its position, saying the main issue facing the UK is a lack of terminal and runway capacity in the south east of England.

Lee Coppack is editor of Strategic Risk's sister publication, Catastrophe Risk Management, E-mail: lee.coppack@strategicrisk.eu