Sector spotlight: how mining companies can manage growing ESG, regulation, and talent risks

With a long and well-documented history of incidents, and significant regulatory and environmental pressures, risk leaders in the mining sector need next-level diligence and innovation to manage such a high-risk environment.

These challenges have seen the industry develop holistic approaches to risk management, integrating environmental, social and governance (ESG) considerations into their strategies while tapping into technological aids in their battle for mitigation.

FIVE KEY RISKS EXTRACTED

The Australian Mining Risk Forecast 2022/23, which extracted key insights from mining leaders, named the five key risks facing the industry as:

• commodity price risk
• financial risks
• the war for talent
• community relations and social licence to operate
• environmental risks, including new regulations.

Caron Sugars, head of mining risk advisory at KPMG Australia, and co-author of the report, believes the skills shortage is a major challenge that creates new intrinsic risks, as firms struggle to get the right people in place.

“Knowledge has also been lost when people have moved between mining companies. This increases the risk environment as corporate knowledge regarding how to manage and prevent risks may have been lost,” she says.

At the same time, the growing focus on ESG and particularly decarbonisation is leading to increased exposures across the sector.

“Political instability, nationalisation and the global trade conflict threat have all become front-line factors that must feature highly on risk managers’ agendas.”

This is because projects aiming to achieve decarbonisation will require capital outlay by an amount that is yet to be determined by many mining companies.

“The impact on the cost base is uncertain and technology to progress decarbonisation is still being developed in many cases… However, notwithstanding the above, the mining sector is the industry where we are seeing the most progress in decarbonisation and addressing of ESG requirements more broadly,” Sugars says.

The report also found that COVID-19 was greatly demoted as a major industry risk in 2022, as the impact of the pandemic abated.

Instead, supply chain issues have become more prominent, while political instability, nationalisation and the global trade conflict threat have all become front-line factors that must feature highly on risk managers’ agendas.

HOW TO MITIGATE

In terms of how the mining industry is tackling such risks, one piece of good news is that COVID-19 saw the reintroduction of scenario considerations into boardrooms.

Directors and management have seen the benefits of this approach and the impact it has on their company’s overall risk profile.

Consequently, firms are using this technique to work through strategic risks and make sure they are tackling emerging risks at the same time.

However, that approach primarily concerns identification of key risks. When it comes to mitigation strategies, tactics are varied. But the mining industry has built on its many successes around decarbonisation, bringing project management skills that are now second nature to other areas of risk.

“Risks are able to be managed accordingly, as they become project risks, with the necessary investment and attention aligned to the risk appetite.”

For instance, a spokesperson for Fortescue – one of the world’s largest iron ore producers and exporters told StrategicRISK: “Fortescue’s approach to risk management helps to guide our people in making informed decisions that create and sustain shareholder value as we pursue our strategic plans.”

“This includes achieving our… decarbonisation targets, responding to changing ESG expectations, and evolving our business to a global metals and green energy company.

“We also leverage our risk management framework to build a resilient business that can respond to evolving economic, geopolitical, technological and societal impacts.”

Sugars says: “Tackling decarbonisation through utilising solid project management principles is something we are seeing more of. This means the risks are able to be managed accordingly, as they become project risks, with the necessary investment and attention aligned to the risk appetite. This is one of the most successful approaches we are seeing.”

“The Fortescue Risk Management Framework provides a structured approach with clear accountabilities for risk management across the business.”

Fortescue says that the company looks to foster a strong risk culture to promote risk awareness and informed decision-making across all its activities.

“The Fortescue Risk Management Framework is based on international standards and provides a structured approach with clear accountabilities for risk management across the business.”

The spokesperson added that it concentrates on taking risks for strategic reward in line with the board’s risk appetite, to sustainably grow the business. This is achieved by recognising the importance of effective, transparent risk management.

WHAT DOES THE FUTURE LOOK LIKE?

When it comes to the future of the sector, Sugars highlighted the inevitability of new risks and opportunities, but stated that ultimately the way that risks are managed will depend on technology.

“As more companies embrace integrated governance, risk and control/compliance systems, it follows that risk management becomes more efficient. In turn, more reliance can be placed on the second line to ensure mitigating controls are operating as required.”

This moves the responsibility for risk to the managers responsible for those risks rather than leaving it with the group/head office risk function.

“As more companies embrace integrated governance, risk and control/compliance systems, it follows that risk management becomes more efficient”

The outcome is embedded risk management, not a spreadsheet updated on the side. This will mean group and head office risk teams can then focus on strategic risk management and theming of operational risks to proactively identify areas where risks may be trending upwards.

Sugars concludes: “[Risk managers] will be doing root cause analysis to address any concerns before risks eventuate – adding strategic value rather than spending most of their time on risk reporting.

“The systems also link governance and compliance with risk management. This enables a holistic view of risk, together with clarity around risk rating obligations and reporting on noncompliances, which may increase the risk profile.”