Risk Management Practices For Maersk Group: A Risk Audit Report

Risk Management Audit

Maersk Group is a Danish company that provides transportation and logistics services in over 130 countries. The company has its head office in Copenhagen, Denmark and subsidiaries across the world with over 88,000 employees working for it. It has a fleet of over 650 container ships and it transports over 15 million containers through these ships around the world. This is a report on risk management practices that is used by the company for managing its risk portfolio. The report would investigate the risk management strategies used by the company with an aim to assess their effectiveness. It would analyze the current risk faced by the company and would do its mapping. The report would also explore how risk management practices like disaster recovery, risk contingency planning, and business continuity planning can be used by the company. The organizational structure used for risk management along with the control processes would also be analyzed in this risk audit report.

Risk Management

The company uses standard steps for managing risks in the organization including risk identification, assessment, ranking and response planning.

Risk Identification: The micro and macro aspects related to multiple organizational and industrial perspectives can be explored to identify risks faced by the organization. These include social, political, temporal, environmental, financial, legal, geographical, technical, managerial, and outreach perspectives. These perspectives can act as key risk topics and when they are delve deeper into, sub-topics related to risks can be identified which would help in identification of specific risks or risks that may be faced by the logistics and transportation services organization.

Risk Topic Save Time On Research and Writing Hire a Pro to Write You a 100% Plagiarism-Free Paper. Get My Paper	Risk Sub-topics	Risk	Risk Description
Social	Cultural Change	Employee resistance	The company is going through a cultural change that may not be accepted easily by its employees who may fear the change as negative. This causes resistance in employees towards change (JOC Staff, 2014)
	Competition	High competition reducing market share	If the competition is high then the market share of the company would be affected. One of the major competitors of Maersk is Hanjin in Korea which is fighting with Maersk for the first position in the high end shipping segment (Andersen, 2013)
Technical	System	Cyber attack	If the IT systems used by the company face problems like cyber attacks, they can cause disruptions in its operations. The company’s systems had faced a major cyber attack that had affected most of its applications such that the systems had to be shut down.  Maersk took a week to make 1500 of its applications functional again after the attack was identified (Reuters Staff, 2017).
Political	Security	In-transit loss of goods	If the cargo gets damaged in transit then it leads to a loss for the customer of the company and a reputation loss for Maersk (Colina, 2011)
Financial	Revenue loss	Increase in cost leading to revenue loss	If the freight rates and oil prices rise, it would affect the operational profits of the company leading to loss of revenues because of increase in cost of operations
Infrastructure	Transportation delays	Poor infrastructure causing delays in delivery	If the infrastructure used for transportation of goods such as port infrastructure near seas is not up to the mark or not sufficiently developed then it can cause delays in transporting goods to customers of Maersk
Environmental	Air Pollution	Air pollution from ship emissions	The ships used for transporting goods via sea cause emissions that can pollute the environment. Shipping contributes 4% to the global CO2 emissions (The Gaurdian Team, 2011).
Outreach	Marketing	Incorrect customer segmentation	The company has been trying to develop a segmentation model for the categorization of its customers but failed to come up with an effective model which made it difficult for the company to market itself efficiently (Jerkovi? & Adeltoft, 2012).

Risk Assessment: The strategic objectives of the company can be explored to understand how the identified risks can affect the strategic positioning or operations of Maersk group. Strategic objectives of an organization can come under any of the common four categories including provision of highest quality of products or services, creation of global environment, providing efficient solutions, and creating cooperation with the social and business environment.

The strategic objectives of the company can be identified along each of these categories as follows:

• Highest quality of products and services: Delivery best in class logistics and transportation services to customers by leveraging on digitization and customization
• Global Environment: Developing structured business solutions for customer organizations across globe
• Cooperation with the environment: Building a strong capital structure and bring the financial ratios in line with the ratings of investment grades.
• Efficient solutions: Reorganize business structures to bring synergies in different departments and new product development processes.

Risk assessment can be done considering these objectives that would form the basis of the ranking given to identify risks.

Table A: Risk Impacts

Impact  Level	Descriptor	Description
0	Negligible	No financial loss
1	Minor	Some financial and reputation loss
2	Moderate	Moderate financial and reputation loss
3	Serious	Serious loss that can interrupt operations of business
4	Severe	Major financial loss or business interruption
5	Catastrophic	Failure of the company (Avdoshin & Pesotskaya, 2011)

Table B: Risk Probabilities

Probability Level	Descriptor	Description
0	Impossible	May never happen
1	Rare	Can appear occasionally
2	Unlikely	Can appear at times
3	Moderate	Will occur some time
4	likely	Can appear in most situations
5	Most certain	Event would happen (Bayne, 2002)

Risk Ranking: Based on impact level and probabilities of occurrence, risks can be given ranking from acceptable, moderate, significant, and severe to high risk.

Risk Management

	Risk Probability
Impact  Level	0	1	2	3	4	5
0	0	0	0	0	0	0
1	0	1	2	3	4	5
2	0	2	4	6	8	10
3	0	3	6	9	12	15
4	0	4	8	12	16	20
5	0	5	10	15	20	25
Risk Category	No Risk	1-3: Acceptable	4-7: Moderate	8-13: Significant	14-19: Severe	20-25: High Risk (Bodicha, 2005)

Risk Matrix: A risk matrix can be used to identify each risk and the ranking given to each risk based on probability of its occurrence and the impact on the company

Each identified risk can be given ranking based on its likelihood of occurrence and impact on the project to form the risk matrix as shown below:

Risk	Explanation	Impact	Probability	Ranking
Employee resistance to change	It would majorly affect the strategic goals of creating global environment, efficient solutions, and building a cooperative environment	5	4	20
High competition reducing market share	High competition is already there and it affects the market position of the company	4	5	20
Cyber attack causing disruptions	It would majorly affect the functioning of logistics and transportation operations as they are largely dependent on technologies	5	3	15
In-transit loss of goods of customer goods	This is less likely to occur and the impact would also be minimal with only a few customers affected	3	2	6
Increase in cost leading to revenue losses	Increase in oil and freight prices is more likely to occur but the damage would not be major as adjustments  can be made	3	4	12
Poor infrastructure causing delays in delivery	Poor port infrastructure can be faced in developing countries but it would only cause minimal strategic damage through delays	3	4	12
Air pollution from ship emissions causing environmental impacts	Air pollution is a common problem with shipping operations and it would affect the creation of cooperative environment	3	5	15
Incorrect customer segmentation causing marketing challenges	Incorrect segmentation leads to wrong targeting of customers which would affect the creation of global and cooperative environment that is supportive to business goals of the company	5	2	10

Risk Response: Risk Reponses can be acceptance of risk, avoiding of risk, transfer of risk and risk mitigation. The choice of appropriate response plan is based upon the level of the severity of the risk. For instance, risks that are high or severe are usually avoided and in case they cannot be, risks may be transferred to a third party. Risks that are moderate or significant are either avoided transferred or mitigate in case either are not possible (Curtis & Carey, 2012)

Risk	Ranking	Descriptor	Response
Employee resistance to change	20	High Risk	Avoid by creating awareness of benefits of change and providing training to employees to get buy-in
High competition reducing market share	20	High Risk	Mitigate by aggressive marketing and customer targeting and by providing innovative solutions to stay ahead
Cyber attack causing disruptions	15	Severe	Mitigate by running disaster recovery plan
In-transit loss of goods of customer goods	6	Moderate	Transfer the risk from the loss to freight forwarded or the insurance insurance company (Solomon Island Government, 2009)
Increase in cost leading to revenue losses	12	Severe	Mitigate the risks by restructuring and cutting costs
Poor infrastructure causing delays in delivery	12	Severe	Mitigate by proper planning so as to minimize delays
Air pollution from ship emissions causing environmental impacts	15	Severe	Mitigate by using ships that less CO2 emissions
Incorrect customer segmentation causing marketing challenges	10	Significant	Improve the segmentation strategy that effectively identifies customer segments for marketing (Engine Yard, Inc., 2014)

Disaster recovery is the process which is used to recover the data that is lost after a critical incident faced by the infrastructure of an organization. Maersk had faced a major cyber attack from Petya in 2016 which is a ransomware which asked for a hefty for data recovery. However, due to a strong disaster recovery strategy in place, the company was able to overcome the challenges and recover its data as well as resume its 1500 applications across the organization within a week after the detecting the intrusion.

Besides cyber attack, there can be several more causes of disaster in an organization such as other human induced damages and devastations caused by natural calamities. The disaster recovery plan can have different steps that are decided based on different situations (JIRA Security and Privacy Committee (SPC) , 2007).

For example, following recovery steps would be used in case Maersk headquarter in Copenhagen is destroyed by a natural calamity like earthquake or fire:

• Set up a temporary headquarter in a new location in Copenhagen
• Allocate some of the staff to ensure that operations are uninterrupted
• Transfer the backup files data to the new location systems
• Shift the management team to the new facility
• Conduct repairing of the old headquarter
• Announce the change of address of the headquarter to the public (Delhi Government, 2014)

Following recovery steps were used by Maersk when it was faced with the cyber attack:

• All the running IT systems were shut down as soon as the attack was reported
• A communication was sent to all the customers about the shut down
• Public announcements of attacks and recovery initiative were made with an assurance of fast recovery
• Systems were checked to identify those affected and those safe
• Systems that were unaffected by the attack were started again and the business from selected ports were resumed including Algeciras, Buenos Aires,  Callao Lima, Itajai, India and Tangier.
• Bookings were started with limited applications running including INTTRA and EDI
• Bookings in locations where applications could not be run, manual bookings were started
• Data was recovered from the backup systems
• Normal operations were resumed(Arden Group, 2017) 

Business Continuity planning includes identification of systems that are critical to an organization, analysis of risks that are faced by the company by causing disruptions in these systems, determination of likelihood of the risk occurrence and development of a plan for recovering and resuming disrupted services (Ting, et al., 2009).

Following steps can be used for business continuity:

Step 1: Initiation of business continuity plan

Step 2: Assessment of risk probability and assessment

Step 3: Development of recovery strategies to deal with risks when they occur

Risk Identification

Step 4: Disaster recovery

Step 5: Test the recovery strategy

Step 6: Training the staff on recovery strategies

Step 7: Update the Business Continuity plan (OECD, 2014)

Different BCP steps may be needed for different situations of disasters as explained in the examples below:

Situation:	Dissatisfied employees going on strike	Competitors having advantage because of faster adoption of new technologies	Cyber attack
Step 1	Inform the top management about the strike	Assess the technology	Shut down all systems
Step 2	Form a team for managing emergency	Negotiate with technology seller for purchase	Communicate the disruption to customers
Step 3	Negotiate with labour representative  and arrive at acceptable terms	Test technology on pilot	Start systems that are unaffected by attack
Step 4	Resume the operations with available staff	Use technology for limited services to ensure that in case the technology fails, all operations of the company are not disrupted	Start operations in limited locations
Step 5	Inform the public about the resolution and terms agreed upon	Announce the new technology adoption to customers and to the public	Start applications that are unaffected
Step 6	Start business activities as normal	Start the activities again	Start using applications in limited locations
Step 7	If negotiation fails, hire new people for work	Employ more people if needed for new technology adoption (Ting, et al., 2009)	Purchase new systems and transfer data backup on these systems

TO control the security specific risks from affecting the company, assess the vulnerability of systems at each layer of OSI model and take appropriate control measures.

Layer	OSI Layer	Risk Control
1	Physical	Use universal standards for Ethernet Install UPS to deal with situations of power outages
2	Data link	Allow correct message routing using address resolution protocol
3	Network	Take routing decisions based on network security protocols and give restricted access to network users (SLAC, 2009)
4	Transport	Use Transfer Control Protocol for checking transmission errors and Use UDP for the reliability of transmission
5	Session	Use password authentication for giving access to users
6	Presentation	Use universal data transfer standards
7	Application	Install softwares for anti-virus ad anti-malware on systems (Armour, 2017)

Conclusions

The report discussed how risk management, disaster recovery, and business continuity planning can be used to manage mild to catastrophic risks in an organization. A case of a transportation and logistics service provider named Maersk was taken and the risk management system, DR planning and BCP processes were explored considering different situations of disasters. It was found that risk management process involves identification of risks and their ranking based on their probability of occurrence and impact on the strategic goals of the project. Ranking can then be used for identifying appropriate response strategy. It was found that the steps involved in disaster recovery and business continuity planning are different with different types of risk situations.

References

Andersen, O., 2013. Competitors go after Maersk where it hurts. [Online]
Retrieved from: https://shippingwatch.com/articles/article5196893.ece
[Accessed 10 October 2017].

Anderson, R. C., 2010. Risk Management and Corporate Governance, s.l.: OECD.

APM Group Ltd, 2017. DEFINING RISK: THE RISK MANAGEMENT CYCLE. [Online]
Retrieved from: https://ppp-certification.com/ppp-certification-guide/52-defining-risk-risk-management-cycle36
[Accessed 14 September 2017].

Arden Group, 2017. What lessons can you learn from the Maersk cyber-attack?. [Online]
Retrieved from: https://arden-group.co.uk/2017/07/03/what-lessons-can-you-learn-from-the-maersk-cyber-attack/
[Accessed 10 October 2017].

Armour, D., 2017. Understanding Security Using the OSI Model, s.l.: SANS Institute.

Avdoshin, S. M. & Pesotskaya, E. Y., 2011. Software Risk Management: Using the Automated Tools, s.l.: Russian Federation.

Bayne, J., 2002. An Overview of Threat and Risk Assessment, s.l.: SANS Institute .

Bodicha, H. H., 2005. How to Measure the Effect of Project Risk Management Process on the Success of Construction Projects: A Critical Literature Review. The International Journal Of Business & Management, 3(12), pp. 99-112.

Colina, E. V. d., 2011. Who bears the burden of proving the cause of cargo damage?. [Online]
Retrieved from: https://www.incelaw.com/tw/knowledge-bank/who-bears-the-burden-of-proving-the-cause-of-cargo-damage
[Accessed 10 October 2017].

Cooper, R., 2004. Risk Analysis and Preventing Information Systems Project Failures, s.l.: School of Computing and Mathematical Sciences.

Curtis, P. & Carey, M., 2012. Risk Assessment in Practice, s.l.: COSO.

Delhi Government, 2014. HAZARD, RISK AND VULNERABILITY ANALYSIS, New Delhi: Delhi Government.

Engine Yard, Inc., 2014. Security, Risk, and Compliance, s.l.: Engine Yard.

Health and Safety Authority, 2006. Guidelines on Risk Assessments and Safety Statements , Dublin: Health and Safety Authority.

Jerkovi?, I. & Adeltoft, J., 2012. Maersk Line Case, s.l.: Maersk Lines.

JIRA Security and Privacy Committee (SPC) , 2007. Information Security Risk Management for Healthcare Systems , s.l.: MITA (Medical Imaging & Technology Alliance) .

JOC Staff, 2014. New Book Probes Changing Maersk Culture. [Online]
Retrieved from: https://www.joc.com/maritime-news/container-lines/maersk-line/new-book-probes-changing-maersk-culture_20140528.html
[Accessed 10 October 2017].

OECD, 2014. Risk Management and Corporate Governance, s.l.: OECD.

Reuters Staff, 2017. Maersk brings major IT systems back online after cyber attack. [Online]
Retrieved from: https://www.reuters.com/article/us-cyber-attack-maersk/maersk-brings-major-it-systems-back-online-after-cyber-attack-idUSKBN19O0X8
[Accessed 10 October 2017].

SLAC, 2009. Research Support Building and Infrastructure Modernization: Risk Management Plan, s.l.: SLAC.

Solomon Island Government, 2009. National Disaster Risk Management Plan, s.l.:Solomon Islands Gover Nment.

The Gaurdian Team, 2011. Maersk claims new ‘mega containers’ could cut shipping emissions. [Online]
Retrieved from: https://www.theguardian.com/environment/2011/feb/21/maersk-containers-shipping-emissions [Accessed 10 October 2017].

Ting, J. S.-L., Kwok, S.-K. & Tsang, A. H.-C., 2009. Hybrid Risk Management Methodology: A Case Study. International Journal of Engineering Business Management, 1(1), pp. 25-32.