In this episode of the Pipeliners Podcast, Russel Treat welcomes first-time guest Justin Shannon of Marathon to discuss risk management in pipeline operations.

The discussion centers on the misunderstanding of what exactly risk management is. Justin helps clear up what risk management is — and is not — plus discusses industry models used to perform risk analysis. The discussion also hits on how the science of risk management can be applied to any kind of decision-making.

Pipeline Risk Management: Show Notes, Links, and Insider Terms

• Justin Shannon is a Strategy Advisor at Marathon Petroleum Corporation (MPC). Connect with Justin on LinkedIn.
• Marathon Pipe Line (MPL) is a subsidiary of Marathon Petroleum Corporation that owns, operates, and develops midstream energy infrastructure assets. MPL operates pipelines, storage tanks, and barge dock facilities.
• A Risk Management professional uses decision analysis tools to help decision-makers in an organization make better decisions after weighing the risks.
• Decision Analysis tools include a set of mathematical formulas and equations to create different risk models that allow decision-makers to select a clear path or an alternative path.
  • Bowtie analysis is a risk evaluation model that can be used to analyze and demonstrate causal relationships in high-risk scenarios.
  • Monte Carlo analysis is a simulation model that uses probability distribution to substitute for unknown values to help determine outcomes, thereby reducing risk.
  • Event Tree analysis is a logic-based model that uses probability to follow a sequence of likely outcomes after an undesired event occurs to help determine the risk level.
• Stress corrosion cracking occurs when there is stress on a pipeline, causing cracking. The greater the tensile stress on the pipe, the greater risk of cracking.
  • Cracks in pipeline inspection refer to breaks, splits, flaws, or deformities in the surface of a pipe.
  • Corrosion in pipeline inspection refers to a type of metal loss anomaly that could indicate the deterioration of a pipe.
    • Corrosion pit is a centralized location or hole where there is clear evidence of metal loss.
    • Puddle weld is another type of metal loss along the pipeline.
• PSIG (Pipeline Simulation Interest Group) facilitates the interchange of information and the advancement in modeling, simulation, optimization, steady-state and transient flows, single and multi-phase flows, and related subjects when applied to fluid pipeline systems.
  • The 2019 PSIG Conference was held May 14-17, 2019, in London.
  • Philip Carpenter, Morgan Henrie, Yoshihiro Okamoto II, and Paul Liddell gave a whitepaper presentation, “Probabilistic Analysis of PHMSA Data for Pipeline Spill Risk Analysis.” Included was a discussion of using the Monte Carlo spill risk simulation methodology.
• Integrity Management (Pipeline Integrity Management) is a systematic approach to operate and manage pipelines in a safe manner that complies with PHMSA regulations.
  • CFR 192 and 195 provide regulatory guidance on the pipeline transport of natural gas and hazardous liquids, respectively.
  • HCA (High-Consequence Areas) are defined by PHMSA as a potential impact zone that contains 20 or more structures intended for human occupancy or an identified site. PHMSA identifies how pipeline operators must identify, prioritize, assess, evaluate, repair, and validate the integrity of gas transmission pipelines that could, in the event of a leak or failure, affect HCAs.
• McF is a unit of measurement in gas measurement that indicates 1,000 cubic feet of natural gas.
• RIMS (The Risk Management Society) is the preeminent organization dedicated to educating, engaging, and advocating for the global risk community. RIMS represents more than 3,500 corporate, industrial, service, nonprofit, charitable, and government entities throughout the world.

Pipeline Risk Management: Full Episode Transcript

Russel Treat:  Welcome to the Pipeliners Podcast, episode 78, sponsored by Gas Certification Institute, providing training and standard operating procedures for custody, transfer, and measurement professionals. Find out more about GCI at gascertification.com.

[background music]

Announcer:  The Pipeliners Podcast, where professionals, Bubba geeks, and industry insiders share their knowledge and experience about technology, projects, and pipeline operations. Now your host, Russel Treat.

Russel:  Thanks for listening to the Pipeliners Podcast. I appreciate you taking the time, and to show that appreciation, we’re giving away a customized YETI tumbler to one listener each episode. These tumblers are becoming quite the desired gift. In fact, I am even having people who were guests on the episodes come back to me and say, “How do I get a tumbler?”

To find out how you can get a tumbler, just like what every guest has to do to get a tumbler, stick around to the end of the episode.

This week, we have with us, Justin Shannon with Marathon Pipe Line. He’s going to talk to us about risk management. I am looking forward to this conversation.

Justin, welcome to the Pipeliners Podcast.

Justin Shannon:  Thanks for having me, Russel.

Russel:  So good to have you. Just so that the listeners know, Justin is the fellow math geek.

[laughter]

Russel:  That’s a gentle tee-up because what I wanted to do first is ask you about your background and how you got into the pipeline business.

Justin:  Probably, a math geek. My background is mathematics, got a master’s degree in mathematics from a local university here in Ohio, Bowling Green State University, and then taught high school math for two-and-a-half years.

That’s what I did before I came to Marathon, and then came to Marathon into the pipeline risk group, and spent some time there. After that, became the Enterprise Risk Management Coordinator, which actually set my finance group, and was also a part of a team that looked at how to improve our risk analysis around our capital investments.

Since December, I’ve been in our light products strategy analysis group, a shift from risk management to the business side of things, but most of my career has been in the risk management side of the business.

Russel:  I think this is actually a tee-up, Justin, because the question I have is what is a risk professional?

Justin:  [laughs]

Russel:  I think risk management is a term that gets bandied around a lot in our business, but I’m not sure people really understand it. What is somebody who is a risk management professional, what does that mean?

Justin:  In the broadest sense, I think it’s anyone who practices risk analysis, risk management, which can be kind of an ambiguous term in and of itself. Usually your risk professional is somebody who in a pipeline organization will sit in either a risk group, or maybe the integrity group, some type of operations group, and they’re looking at the risks on the pipeline.

What are some of the threats on the pipeline that could cause a release, that could cause us to have to shut down a pipeline? I think of risk professional a little bit more broadly.

I think it’s anybody who is using decision analysis tools to help people make better decisions to think about the risks around the decisions, specifically some of those higher-level decisions like strategic decisions, budgeting decisions, things that where you’re going to get the most bang for your buck.

Russel:  What would be an example of a decision analysis tool?

Justin:  One of my favorite tools, it’s actually called a bowtie analysis. It was originally created by Shell, I think sometime in the ’80s. It gets its name from it looks like a bow tie. It was originally used in the process hazard, process safety analysis field. What it does is it says, give me some type of event. It might be an explosion, it might be a pipeline release. Stick it here in the middle, the knot on my bow tie.

Then on the left-hand side, you’re saying what are all the things that could cause that event to happen? What are all the measures or preventions we have in place today to stop those things from happening, to cause that explosion or pipeline release.

On the right-hand side of your bow tie you’re listing out things, the consequences. If that event happens, what are some consequences to our company? It might be some financial damage that we have to spend money to remediate. Could be loss of life. Could be some environmental type damage.

I think it’s a nice visual tool to really paint the picture of an event and help with decisions when you’re trying to figure out, what do we do to protect ourselves? What do we really do to meet our objectives?

Russel:  To what degree does your background in mathematics play a hand in risk analysis?

Justin:  I mentioned the bowtie analysis, which is a visual tool. One of my favorite things to get into is some of the math, some of the statistics around risk analysis. Monte Carlo analysis is a tool.

Monte Carlo analysis is basically simulation analysis on steroids. It’s taking a bunch of different scenarios, picking from random variable distributions, and then building a final distribution of an outcome or an objective.

For example, you might build a distribution of failure pressures for a crack, or a corrosion pit, or a puddle weld and say, “We have some information on this anomaly. There is some uncertainty around it.” Instead of saying the failure pressure is X, you could actually say the failure pressure is this distribution of possible values.

That’s one. Monte Carlo analysis is a very powerful tool. It’s been around for 50 or more years, probably more than that, but it’s still one…I’d say it’s the golden tool of risk analysis.

Event trees, failure trees are great for laying out a series of events. You’ve got influence diagrams, trying to understand what could influence a decision or a series of events.

There’s all types of tools out there. They’ve been around for a long time. You can usually find them under the banner of decision analysis.

Decision analysis was actually created by a couple of professors from Harvard and Stanford, I believe going back to the 1960s, where they were using these risk analysis tools, the Monte Carlo, the event trees, to study these types of problems.

Russel:  I find this stuff fascinating. I was at the Pipeline Simulation Interest Group last week. One of the papers was on risk analysis for offshore pipelines in the North Sea. One of the things they evaluated was anchor strikes.

I found that fascinating how they take and they come up with a number to say, “Well, this is my probability of an anchor strike,” and trying to combine what’s the probability of a strike versus the size of ship and the size of anchor does the strike, versus how deep the pipeline is, and what the currents are, and what the weather is.

Take all of that and boil it down to a number. I find that fascinating. To me, it seems a little bit like black magic. You guys, if I weren’t a math geek, I’d probably be saying, “You guys are just making this stuff up.”

What would be your argument, what would you tell somebody that is saying, “You guys are just taking and doing all kinds of creative math to make something up.” What would be your argument with those guys?

Justin:  I think, Russel, as a good practitioner of risk management it’s my job, it’s our job to make those type of things understandable for other people. You’re talking about, really, it just comes down to good old probability and statistics. It doesn’t do anybody any good if you present them with 15 tabs of a spreadsheet and a 50-page report. Nobody understands it.

You have to give decision-makers information that they use, and that they can understand, and feel comfortable using because if you put together a science fair project but nobody understands how to use it, you haven’t added much value to your organization.

There’s this balance of using the proven scientific methods to understand uncertainty around a problem or a decision, but also making it simple enough and communicating it in a way that people can use it.

Russel:  Yeah, taking all this data and doing something to present in a way I have an actionable decision to make.

Justin:  Exactly.

Russel:  I think a simple example of that in the pipeline world would be, I do all this analysis and then, based on this analysis, I make a determination about what pressure I operate my pipeline at.

Or, probably more appropriately, I look at something that helps me understand what range of pressures I operate at and under what circumstances I’m willing to operate under that range of pressures.

That’s a little bit more advanced, but both of those things get backed up with what you’re talking about, in terms of decision analysis, and risk analysis, and all of that.

Justin:  I like what you said about ranges. Part of good risk management philosophy is just admitting uncertainty. I’ve been in the finance world for a little while. We like to have single numbers to say, “This is a 20 percent return project,” but in reality we’re not that good.

Maybe it’s a 15 to 25 percent return project. The same thing, coming back to pipeline operations. I’ll give you a real-life example.

Maybe we think we’re going to need 20 sleeves to deal with the repairs we need to make on our next integrity set of digs. You can actually use Monte Carlo analysis to come up with a range of numbers and say, “Maybe we think we’re going to need 20 pipeline sleeves to make these repairs, but we can be 80 percent confident that it’s going to be between 15 sleeves and 30 sleeves.”

Then, you have a decision to make. I want to be prepared for that upper end. Maybe I buy 25. Maybe I buy 30 or have a certain amount on site and ready to go.

Russel:  I think that’s a really, really good illustration about what this is. People that talk about Monte Carlo and statistics and that kind of analysis, it’s more easily applied to gambling.

Justin:  It’s true.

Russel:  It is true. The only reason that’s true is because the constraints are very well defined. If you think about…I used to play blackjack. I haven’t played blackjack in years and years, but there are things you can do to take the odds and turn them in your favor.

A simple example would be that the average hand of blackjack is three cards. One in three cards in the deck, on average, is a 10 count. If I count the number of hands and I count the number of 10 counts, I can create a ratio. That ratio is going to tell me whether I have a higher probability or a lesser probability to get a 10 in the next card.

Which can inform the decision I make about whether I take a hit or not, or whether I pass that card along, if I’m sitting at the turn, to the dealer and let the dealer take the hit.

Those kinds of things can improve the odds. They’re not specific in terms of outcome, but they do influence decision-making, if done correctly. By doing so, they can improve — over a long series of hands — they can improve your outcome.

You can take that and say rather than just count 10s, I’m going to count 2 to 5, and 6 to 9, and the 10s and the aces. I’m going to track all these things. Based on that, I’m going to have a better idea of what kind of card’s more likely to come out in the next hand and all of that.

You can take these things and make them more complicated and actually help to make a better decision, but at some point…I think this goes to the point you’re making about value. At some point, the system becomes too complicated to actually operate.

Justin:  I like your analogy with the blackjack. I like what you said about you’re actually improving your odds. You’re improving the odds that you meet your objective. That’s what good risk management does.

It’s not necessarily about managing risks. I think you could take any risk manager and ask them, “Do you manage risks?” and they’d say, “No.”

There are business leaders that manage the business. Thereby, they also manage the risks that go along with that business. Good risk management is really about improving the odds of meeting those objectives that the company has.

We can get bogged down in looking at a list of risks, but I think if there’s anybody out there that wants to…if they don’t have a risk management program and they’re looking at a place to start, start with your company objectives. Start with, what does our company really value?

That might be, I would hope, somewhere in your company objectives is something about making money because that’s why most companies exist. There are also non-profits.

Also, if you’re a pipeline company, you’re going to have something about protecting the public, protecting the environment, being operationally efficient, reliable. That’s what the company values.

If you want to start and really add value to your company, start there and figure out what are the things that could stop us from meeting those objectives and put some good risk management practice around those. Ultimately, what you’re going to do is increase your odds of success.

Russel:  That’s right. I think that’s very well stated, Justin. I’m actually talking about this like I know what I’m talking about. I’m making this up as we go along just so that everybody’s aware that that’s what’s actually happening here.

Justin:  You sound great, Russel.

Russel:  [laughs] I know enough about math and I know enough about statistics to have a clue. As I listen to you talk, what’s coming up for me is…It’s really interesting. What are the objectives? What are the things I’m doing that help me simplify decision-making and improve the possibility I’m going to meet or exceed my objective?

That’s a different way of thinking about risk management versus I’m doing something to avoid a loss. It’s not really what’s going on.

If you go back to the blackjack example, if I’m playing blackjack, I’m playing blackjack to make money. I’m not playing blackjack to not lose money.

Justin:  That’s it. Yeah.

Russel:  If you want to play blackjack to not lose money, then you should not play blackjack.

Justin:  [laughs] We’ve got to be careful, trying to…When you look at risk management through the lens of trying not to lose and trying not to have loss event, if you only look at it that way you’re exactly right. You shouldn’t be in the business because if we want to eliminate risk we’ve got to get out of business.

What we really need to do is optimize our decisions, try to minimize the risk, but also maximize reward at the same time.

Russel:  Right. It’s taking a very complex problem and trying to simplify the decision-making.

You mentioned you started out in pipeline risk management and then you moved to enterprise risk management. What’s the difference?

Justin:  When you think about pipeline risk management, my head goes to a DOT PHMSA regulation called 195.452. It’s called Pipeline Integrity Management in High-Consequence Areas.

Basically, the regulation describes the requirements for an integrity management program. Part of those requirements is to have a risk management assessment program, which would then feed into your assessment schedules.

How often do you run a smart tool? How often do you hydrotest your lines? What tools should you be using? That requirement, that regulation, actually says risk factors must be considered.

These are things like you have to consider previous integrity test results, historical repairs, leaks, operating pressures, soil types, potential for earthquakes, landslides, water crossings, nearby waterways that might carry product to another high-consequence area, elevation profiles, the type of product that you’re transporting.

Everything’s in there that…You need to consider these things. There’s actually a regulated risk program that DOT mandates.

When I think about pipeline risk management, I think about that program. Then, shifting to enterprise risk management, I think that’s just a general term. Usually it applies to some type of risk program that is at a very high-level in the organization.

For example, our risk program, it’s the MPC, Marathon Petroleum Corporation Risk Program. It looks at anything that could take down the company. What are the big, big risks that could actually put us out of business type risks?

That might be…We could get a legislative or regulatory change that really hurts our business. We might have a shift in the demand of our products. Maybe some technology comes out that takes away our demand. These are the really, really big risks. It looks across the organization. It flies at a very high level.

You can bring risk management to any level of an organization. You can still apply the same type of decision-making tools.

Russel:  Really, the only thing that’s different is the context. It’s the problem you’re trying to solve or the decisions you’re trying to simplify and improve. The techniques are the same.

Justin:  Yeah. Risk management is just trying to make good decisions and consider the risks while you’re doing that. It could be in a 10,000-foot view or it could be as far down in the weeds as you want. It applies to the context at hand.

Russel:  The thing I always get hung up on, and maybe this is a conversation for a later date. The thing I always get hung up on is how do you come up with the…I understand making lists of things and sequencing those things in terms of what’s the most likely to the least likely, what’s the worst consequence to the least consequence.

That, to me, I understand. When you start putting numbers on this, that’s when I start getting a little lost.

Justin:  I’m a math geek, but I will be the first one to warn anybody about using math and calculations to make things look more precise than they are. I’m a big proponent of using the tried and true methods of the Monte Carlo, using the probability and statistics of that treeage to put a 7 out of 10 on a risk.

I’m not really a big fan of that because what is a seven? It’s higher than a six. When you get into these relative scores, it gets a little hairy. It can be confusing to decision-makers, as well, because they’re trying to understand, “Should I be concerned with a seven? Should I be concerned with a six? Should be concerned with a 10?”

There’s really no way of saying, “Yeah, you should be concerned,” other than, “It’s high.”

Russel:  We’re trained from a very young age to think of math as an exact science. Two plus two is four. It’s always four. It’s never 4.1. It’s never 3.9. It’s always four. Versus, this is not an exact science. This is more of an estimating. What’s important is to understand seven is more risky than six. I’d rather have all sixes and no sevens. That is a hard way to get people to think if they’re not understanding what’s going on.

Justin:  I’d rather see these risk be described in terms of ranges. If this certain event happened, we would lose between X amount of money and X amount of money with this likelihood.

Going back to that, admitting that we’re uncertain. We know that it could be a large number. We know it could be a small number. Putting those ranges helps people wrap their heads around, “I know it’s big. Here’s the range.”

Think back to high school science, physics. Your answer could never be more precise than any of the inputs that went into that answer. You had the significant digits.

The same thing, I think, applies to risk calculations and estimates. If you’re not sure about the inputs that are going into the thing you’re calculating, you probably shouldn’t be rounding to the nearest hundredth.

Russel:  That’s a conversation we have in measurement a lot. I’m measuring 100 McF, but the accountants settle to the penny.

Justin:  Yeah, exactly.

Russel:  I don’t know how to count exactly that molecules. It’s the same kind of thing.

Justin:  One of my inputs was rounded to the nearest thousand barrels. My output is rounded to the nearest tenth of a barrel.

Russel:  I’m moving 100 M. I’ve got a plus or minus one percent. Any number less than a million cubic feet is…

Justin:  Rounded off.

Russel:  It’s insignificant — unless you’re an accountant [laughs], in which case it’s not insignificant at all.

Justin:  We’ve been trained, Russel, to think that if we can come up with a precise calculation it must be more accurate or more believable.

But, I go back to really good risk management is admitting that we’re not sure. Putting some ranges and distributions to things.

Russel:  I’ve got a pure measure of risk of 100, but the standard deviation is 10, versus I’ve got a pure measure of risk of 100 but the standard deviation is 100.

Justin:  Exactly. You’re a measurement guy. You understand that. Every measurement has some type of error to it.

Russel:  That’s right.

We talked a little bit before we got on the mic with your involvement with the Risk Management Society. Why don’t you tell us a little bit about RIMS, and who they are, and what they do?

Justin:  During my time in finance as the enterprise risk management coordinator, I was a member of RIMS, which is the Risk Management Society. It’s probably the largest or one of the largest societies of risk professionals where you can network. They have events throughout the year and different conferences.

While I was the coordinator of enterprise risk management, I made some nice changes to our program. We were actually selected as the Global Enterprise Risk Management Program of the Year.

Russel:  Awesome. That’s impressive.

Justin:  It was pretty cool. We got to go to Montreal to a conference and give a little acceptance speech in front of a group of risk professionals. It was actually interesting. I opened up the speech with a question. “How many of you are risk managers?” Just about everybody raised their hand.

I said, “How many of you manage risks?” Nobody raised their hand.

Going back to, what is risk management? It’s not about managing a list of risks. It’s about managing the business and thinking about risks while you’re doing that.

Russel:  Oh, man. That means they’ve got it named wrong. They have a marketing problem.

Justin:  They do. Got to change the name.

Russel:  It’s value management. That’s what it really is.

Justin:  That’s right, the value. There’s actually a push by a group of risk professionals today to…Some would say rename it to decision-making under uncertainty.

Russel:  That sounds like something a bunch of mathematicians would come up with.

Justin:  [laughs] Yeah. That might not be any better.

Russel:  Would it be true to say that risk management has its roots in insurance and underwriting?

Justin:  I think it definitely has strong roots in insurance and underwriting. If you think about how insurance sets their rates, they have actuaries. They’re using Monte Carlo analysis. They’re using probability and statistics.

It does all go back to the tried and true statistics, mathematics, probability, and statistics.

Insurance has been around for ages. I think they’ve been using math to figure out insurance rates for a long, long time.

Russel:  That’s actually, as I understand the history of Lloyd’s of London, that’s actually how they began to dominate. They got really good at figuring out how to underwrite shipping. You could go and buy insurance from them. If you lost your shipment, you got reimbursed. They figured out how to make money because they insured everything.

They figured out how to set those rates so they made money even though they had to pay you when you lost your ship. That is risk management because I’m managing the risk of losing a ship.

The other thing that’s interesting is if I’m the person providing the insurance, the way I look at it, and the way I quantify the problem is different than if I’m the one running the ship.

Justin:  I think you’re right. It’s funny. We’ve talked about insurance. We’ve talked about gambling. Those two fields are actually really good at describing the two different views on risk. You’re either risk-seeking or risk-adverse.

Some people are risk-neutral, but if you’re a gambler, you’re risk-seeking. The odds are probably against you but you’re going to take on that risk anyway.

If you’re a person who likes to have a lot of insurance, you’re risk-adverse. You want to avoid risk, even though the odds aren’t great that you’ll ever realize the benefits of insurance, which you probably don’t want to realize the benefits of insurance anyway. It might be a risk that might be unlikely but you can’t handle the consequences. You won’t be able to make it through the consequences.

Russel:  It’s like I’m later in life and I have a paid for a house. I’d better have my house insured. That kind of thing.

This is really fascinating. One of the things, Justin, I like to do at the end of many of these episodes is summarize it into three key takeaways. I’m going to make a stab at that and then ask you to render your opinion on my summarization.

Here’s my three key takeaways. The first thing is risk management’s not really about managing risk. It’s really a bit incorrectly named.

The second thing is that what risk management really is … is using methods and models and math to improve your ability to make decisions. That’s done by providing some kind of result of analysis that I can use to either pick a path forward or pick between alternative paths forward.

Then, lastly, I think that it’s that the science of risk management can be applied to any kind of decision-making. It doesn’t really matter what the decision-making context is. It can be applied to any of that.

Do you think I’ve got it right?

Justin:  I couldn’t have said it better myself, Russel. That was beautiful.

Russel:  [laughs] Those are very kind, yet strong, words.

Justin:  I really know you, right?

Russel:  Yeah.

Justin:  I do want to echo that first bullet point, though. It’s not about managing risks. It’s just about improving decisions and using those tried and true risk analysis methods to do so.

Russel:  I think the other thing that’s a corollary here is that I don’t need to be a mathematician to do risk management because many of these tools are more analytical tools than they are mathematical tools.

Justin:  I would agree with that. If you’re not a mathematician, don’t use the math that you’re not comfortable with. Use what you know and use what you’re comfortable with.

Russel:  Any kind of tool that can help you get better, use it. That’s kind of how it pulls out.

Hey, Justin. Thanks for coming on the Pipeliners Podcast. It was great to have you. I would love to have you back in the future. We’ll dig a little deeper into some of these topics.

Justin:  Thanks for having me, Russel. I really enjoyed it.

Russel:  I hope you enjoyed this week’s episode of the Pipeliners Podcast and our conversation with Justin Shannon about risk management.

Just a reminder, before you go, that if you would like to get a cool, customized, Pipeliners Podcast YETI tumbler, what you need to do is go to pipelinepodcastnetwork.com/win and enter yourself in the drawing. That’s the only way you can get one of these tumblers.

If you would like to support the podcast, please leave us a review on whatever smart device app you use, be that Apple Podcast, Google Play, Stitcher, whatever. You can find instructions for how to do this at pipelinepodcastnetwork.com.

[background music]

Russel:  If you have ideas, questions, or topics you’d be interested in, please let me know on the Contact Us page at pipelinepodcastnetwork.com or reach out to me directly on LinkedIn. Thanks for listening. I’ll talk to you next week.

Transcription by CastingWords