Why is this important?
OMV Petrom Vision “ZERO harm – NO losses” guides our behavior, actions, and decisions, therefore our security and resilience services align to our vision by focusing on three key objectives:
- Increase effectiveness and efficiency of our security operations by centrally managing the provisions of cross divisional security operations.
- Ensure the detection and prevention of significant business threats.
- Develop resilience to respond and recover from events with negative impact and develop, maintain, and continuously improve business continuity framework.
We do our best to protect people, assets, operations, and reputation against emerging malicious and/or intentional threats. Our commitments are laid out in our HSSE Policy. To continuously improve the processes and deliver security and resilience services that meet our business needs and expectations, our Security and Resilience Department has implemented the Quality Management System in accordance with ISO 9001:2015 (certified by Lloyd’s Register Quality Assurance).
OMV Petrom is fully committed to ensuring that the Security and Resilience function shall continue to be embraced as an essential resource enabling business competitiveness, and the recent external recognition of our team members are building on this commitment – Member of the Business Continuity Institute (MBCI), ASIS International CPP (Certified Protection Professional) certification, member of the Association of Certified Fraud Examiners (ACFE).
Security Services Contractors Performance Monitoring – We monitor the performance of the security services contractors through the implemented KPIs and improve the quality of security services being rendered. KPIs data is collected and closely monitored through established internal processes such as security inspections, roving patrols, and security incidents reporting. Contractor performance monitoring process ensure that legal and contractual requirements are followed, and the security services delivered at the highest quality standard with focus on equipment, legal required documentation, execution of the service and post attributions.
The reporting of the security incidents is made through the Geographical Information System Mapping software and is initiated by security contractor, subsequently being verified and validated by the local security responsible before report is released to relevant stakeholders. The graphic feature which maps the security incidents occurrence is extremely helpful to understand the threat environment and the main driver for security risk mitigation supporting the redesign of the security operational concepts to cope with the continuously evolving criminal factors.
How we manage Security and Resilience – Security and Resilience department activity starts with the proactive identification of business needs and requirements based on which we are responsible for designing and implementing an integrated framework of processes, regulations, tools, and technologies to enhance Security and Resilience across the company value chain. The Security and Resilience department establishes and maintains a sustainable protection of people, assets and reputation against intentional malicious threats and continuously improves organizational preparedness to respond and recover from serious incidents adequately.
The Security function ensures the integration of the best security practices at the OMV Petrom level and supports business, not only through the delivery of its strategic objectives but also on an operational basis. A special focus is dedicated to managing the provision of operational security services and their effectiveness. A unitary and structured approach, providing company-wide strategic direction addressing all security operations-related topics, is ensured through a centralized management of the security services under the Security and Resilience department. Thus, we ensure increased operating efficiency and compliance with national-specific legislation through country-wide risk-based and flexible security resources allocation.
The Resilience function enables the effective recovery of operations and the preservation of the OMV Petrom brand in case of a significant incident, minimizing potential negative impacts on our business and our people.
All identified nonconformities are assessed and discussed with the service providers during the quarterly quality meetings and addressed by corrective action plans implemented together with the providers.
Security Services Management across OMV Petrom Group sites in Romania are centralized under coordination of the Corporate Security & Resilience department, to ensure:
- a unitary and structured approach providing company-wide strategic direction addressing all security related topics
- increased operating efficiency
- compliance with national specific legislation
- country-wide risk-based and flexible allocation of security resources
- clear accountability for all related processes to ensure control over security services contracts, budget needs (post lists, locations) and allocation, selection of security providers, performance measurement and reporting, costs tracking and administration
Protection of objectives, goods and valuables against any illicit actions that may affect the right to property, their material existence, as well as protection of persons against any hostile acts that may endanger life, physical integrity or health is a legal requirement stipulated under Law 333/2003.
In OMV Petrom, the operational security concept consists of a mix of components: guarding, technical security systems and procedural/organizational measures, which ensure deterrence, detection, prevention, and response to intentional criminal threats against people, assets, operations and reputation. The guarding component based on specialized security agents, certified according to Romanian Law, is a critical element to our protection concept and is carried out by private security contractors in accordance with local guarding plans in place, which are governed centrally by the Security and Resilience Department. In this regard, pedestrian patrols, fixed posts, and roving patrols are ensuring protection of people, guarding of our facilities against unauthorized access, thefts and any other material damages.
Risk-based resources allocation
In OMV Petrom, deployment of the security measures is risk based to ensure proportionate and efficient threat detection and adequate response. Security Risk Assessments (SRA) are meant to identify and classify risks per location and allow the Security Team to evaluate the efficiency of the current mitigation measures in place and trigger necessary improvement.
In addition to legal framework, OMV Petrom is using a best practice methodology to ensure a unitary approach for a Group-wide security risk assessment. The methodology is based on Acumen dedicated software platform for assessing, planning and mitigation risk at corporate levels, which allows monitoring the risk status, generating a common operating picture with real-time insights and alerts to changing realities. Annually, for all OMV Petrom objectives, security risk assessment reports have been revised using ACUMEN, under the Corporate Security and Resilience department’s coordination and direct involvement. Security Risk Assessments process enabled in 2021 the implementation of new measures, such as projects for advanced technological solution in commercial depots and Upstream high-risk facilities for increased efficiency in loss prevention and ensure optimizations of the operational security.
All security incidents occurring on OMV Petrom locations resulting in personal injury or damage to equipment, property, or reputation, or having the potential to do so, are reported to OMV Petrom immediately. Accurate reporting of all security incidents, technical incidents and non-conformities is necessary to analyze and establish measures to prevent the recurrence of similar incidents.
Security Incident Reporting process, it is an important indicator of the efficiency and efficacy of operational security concepts, by indicating if the available resources are allocated properly, in order to prevent or mitigate losses. Security Incidents are regularly analyzed for identifying the causes and develop additional protection measures or updating the operational concepts.
Maintain Quality Management System in Security and Resilience Department
The S&R Department has implemented the Quality Management System in accordance with ISO 9001:2015 (certified by Lloyd’s Register Quality Assurance. In our continuous efforts for improving and becoming more efficient, a customer satisfaction survey has been conducted to more than 60 key interested business representatives, assessing 5 main criteria (e.g., understanding the business needs, response time, value added, innovation and the overall cooperation). The overall score average of all 5 criteria has shown a very good reputation of the Security & Resilience Department among Business Units, but also highlighted areas for improvement.
In addition, for in-depth assessment of the security contractor’s performance, a yearly Audit Program is established for a second party security services with detailed audit objectives ranging from: safety, human rights and other requirements related to the security activity.
The S&R personnel have a constant focus in expanding their professional capabilities by participating in development trainings, exchanging knowledge with peers or sharing industry best practices. The trainings are based on constant needs assessments and legal requirements. The course themes vary from acknowledging the legal provisions that govern the guarding activity, to the increase in the professional preparedness level of the personnel, in terms of intervention, the protection of goods, assets, people, driving regulations and others. A special focus is also placed on the Human Rights policies and principles and on acknowledging the OMV Petrom specific procedures, HSSE provisions and improving the overall quality and efficiency of the services offered.
We monitor the performance of the security services contractors through the implemented KPIs to improve the quality of security services being rendered.
Our plans are developed taking into account the national legislation and internal regulations. The guarding plan mainly establishes the characteristics of the guarded objective, in the respective area, the number of posts and their location, the necessary personnel for security, installations and technical means of security and alarm, and regular duties for the guards. The high complexity rendered by the large number of countrywide distributed sites is tackled through regional guarding plans, which are aligned and approved by local and regional police. This resulting in 26 guarding plans who are managed through an internal process that facilitates monitoring of the status for each guarding plan, thus ensuring its internal revision at least once per year by taking into consideration the results of the regular risk assessments or other modifications that call for amendments of the plans.
At county level, engagement plans have been set through regular meetings with law enforcement authorities, as basis for organizing periodical common preventive actions. The aim of these actions is to mitigate and prevent crime in the exploration and production areas.
One other special focus in managing our security services contractor is the adoption of Voluntary Principles on Security and Human Rights, in this regard OMV Petrom assesses and monitors its risks, identifying customized strategies and solutions, in an ongoing effort to be more effective in preventing and mitigating not respecting human rights in our security operations. At the end of 2021 we have completed a human rights risk assessment, supported by an independent expert. The resulting action plan will be implemented in 2022 by the departments involved in this activity.
Business continuity and crisis management
Our Resilience function is committed to continuously improving organizational preparedness, aiming to build efficient capabilities to respond to, recover from serious incidents and ensure business continuity in situations that generate operational disruptions. OMV Petrom uses a three tiers approach for the management of incidents, emergencies and crises leveraging existing line management. The first priority in any incident, emergency or crisis is always to protect and save lives.
Stakeholder management is paramount when dealing with incidents/emergencies or crisis as such the OMV Petrom crisis management framework sets up the arrangements for efficient communication with local communities as part of the stakeholders’ management process. In case of an emergency, the Communication Department, which is part of the Crisis Management Team, ensures a coordinated response to employees, media and communities.
The Incident Response Plans focus on saving life, protecting property and minimizing damage to the environment by setting clear roles and responsibilities for the personnel onsite so that the technological installations are safely shut down, first intervention teams react depending on the type of incident specific, emergency procedures for high risks and major accident events and the personnel evacuation in a safe manner to the muster points for ensuring a fast and efficient reaction in case of an emergency. A clear and specific part of the response plans is related to the training of personnel involved via classroom sessions and practical drills. Drills are conducted periodically as per the respective response plans’ provisions and are focused on evacuation and first response. The frequency is based on the risk category of the location and/or on the legal provisions that are applicable to the respective location; thus, it can vary from once / month to twice / year.
Action Plan to “ZERO harm – NO losses”: To ensure the successful implementation of the Security & Resilience strategic vision, every year a set of initiatives are identified and defined as projects. For 2021 we developed initiatives to improve key areas such as: incident reporting, employees training & awareness, improve company preparedness to cope with crises and security technologies deployment.
In 2021, we continued to contribute to the overall efforts to prevent coronavirus spread among OMV Petrom employees and contractors and specific attributions were agreed with security contractors to be performed by the security personnel.
Security Incidents Reporting – A very important development of incidents reporting process was identified as a target for 2021 and as such, automation and development of cross-divisional functionalities were in focus during the year. It was mandatory to improve the automation reporting process and include new features to help us better understand the prejudices value and the consequences. A special focus was to implement the automated reporting for the filling stations security incidents, which have an increased dynamic and specific response measures such as intervention teams. The new tool also provides the possibility to assess the security contractor’s performance based on filling station personnel feedback.
Embedding technologies into security operations – Following our strategic direction to embed technologies into our daily security operations, we constantly assess opportunities to replace obsolete equipment with new security systems with up-to-date digital technologies and integrate them to Security Operations Centre based on centralized software platform (PSIM) providing enhanced incident handling. This approach is focused on ensuring an adequate protection level of the sites based on physical security systems to enable early detection and intruders’ recognition, efficient incident management acting simultaneously as a deterrent against intentional malicious threats. Thus, we digitalized our security systems and maximized the use of closed circuit television system (CCTV) latest technologies advancements by adopting equipment with artificial intelligence capabilities based on deep learning algorithms, reducing false alarms and enabling a high detection performance. As such, more than 250 CCTV cameras were installed in Upstream (multiple locations) and Downstream (Petrom Aviation terminals, CCPP Brazi, Petrobrazi Refinery, and other) in 2021.
The operational procedures in our Security Operating Centre (SOC) were fully revised and updated to reflect the new developments, operators received specific training and detailed working instructions for handling the new equipments and features, ensuring an adequate monitoring activity and support for our field security operations.
Improve business continuity and crisis management – In the pandemic context, we continued to contribute to the crisis response providing an accurate monitoring for COVID-19 evolution and related impact in OMV Petrom. We provided support to ensure an efficient recovery phase for our employees, contractors, and clients. In 2021, we started a major revision of Crisis Management and Business Continuity framework in order to adopt most recent international best practice and lessons learnt. As such, the resilience function personnel on international regulation and best practice undertook in-depth research and training. The revision process is scheduled to be finalized in 2022 through the release of the new Crisis Management Plan.
As part of the legal requirement type of documentation, under the provisions of emergency situations and civil protection legislation, the Incident Response Plans are comprehensive documents developed at the facility/site level, as resulted from risk assessment at the county level released by authorities and specific legal requirements to address site specific foreseeable risks. Thus, across OMV Petrom there are more than 2.714 response plans addressing various risks such as intervention and evacuation plans in case of fire or explosion, response plans in case of earthquake, flooding or landslides, civil emergencies, emergencies and disaster management plans etc. According with fire safety and civil protection legal provisions, regular emergency situations drills are performed. In 2021 more than 2,000 drills were performed across company locations and sites.
Changing culture towards security and resilience in OMV Petrom – in 2021 we developed 2 new dedicated e-learning materials tackling general Security & Resilience concepts that each employee can adopt and implement, either in the office environment or operational areas. Moreover, a series of quarterly awareness topics have been delivered through a “Security Minute” program meant to raise awareness on each individual’s contribution towards Security. The four topics: Open Reporting in Security & Resilience, Intention vs Accident (Security and Safety), Security measures during travel, and Securing our office and operational areas, have reached cumulatively more than 400 participants per quarter (own employees and contractors).
In 2021, two security contractor audits were conducted. No major nonconformities have been identified during the audits, and any minor nonconformity that was identified was treated through specific actions over an appropriate timeframe.
The security performance was evaluated at a high level of quality (96% average score).
Approximately 500 security inspections in Upstream and Downstream
1,500 security agents trained within more than 100 hours of training
990 training hours for the S&R team members (Agile methodologies in projects, Digitalization skill-set, and best practices in Crisis Management & Business Continuity)
>200 preventive actions were organized with the law enforcement agencies
Risk-based resources allocation
381 security risk assessments were performed in 2021, across both Upstream (at production area level – 36 security risk assessments) and Downstream (341 filling stations and Refinery and depots – 4 assessments), in order to cope with structural changes of the locations, business developments, or due to expiration of the validity legal period.
The certification of Security & Resilience Quality Management System has been maintained following the annual surveillance audit conducted by Lloyd’s Register Quality Assurance in March 2021, confirming the professionalism of the services delivered to our Business Units.
Implementation of state-of-the-art perimeter detection and control access security solutions in Petrom Aviation terminals, depots, CCPP Brazi and Petrobrazi Refinery.
Improved employee awareness of security and resilience principles and behaviors by designing and delivering new security awareness topics through the quarterly Security Minute Program.
Looking forward we aim to:
- Foster transition from traditional to digital security by maximizing deployment of modern technologies into daily security operations for new projects and opportunities to implement additional security measures to mitigate security vulnerabilities of our operational facilities.
- Explore opportunities for working with our security contractors to optimize physical security in Upstream onshore operations. We plan to also develop a detection and response to concealed theft of petroleum product.
- Improve organizational resilience by assessing pandemic lessons learned and international best practice to embed them in the revised Crisis and Emergency Preparedness and Business Continuity framework.
- Continue to ensure legal compliance while applying our risk-based flexible resources allocation for all Company sites through provision of Security Risk Assessments.
- Continuous improvement of the S&R Quality Management System, including confirmation by Lloyd’s Register Quality Assurance, and other ISO management system standards requirements, especially regarding security management systems for the supply chain and risk management.
- Continue the trainings on human rights for the security personnel. Moreover, a revision of the existing contractual provisions with regards to human rights will be performed.
- The Human Rights action plan will be implemented in 2022; the plan was developed as a result of the 2021 human rights risk assessment.