1. Identify, Analyze and Quantify All Risks

Identify all of the company's energy commodity related risks including market, basis, operational, credit, liquidity and regulatory risks. Once all risks are identified, they can be reviewed, categorized, quantified and prioritized. Most energy market related risks can be rigorously analyzed via quantitative and statistical analysis, while some risks have to be evaluated through a qualitative approach. Risks that are not properly identified and analyzed cannot be effectively managed or mitigated.

2. Determine Risk Tolerance and Develop Risk Management Policy

All relevant risks should be addressed through a process that establishes risk management goals and objectives as well as risk tolerance. An energy risk management policy, also known as an energy hedging policy, should then be developed to formalize the goals, objectives and risk tolerance, clearly define the decision-making process and determine who (individuals and/or committees) is responsible for the various front, middle and back offices tasks related to the policy. 

3. Develop Hedging Strategies & Procedures

All potential strategies i.e. forward contracts, futures, swaps and options, should be approved, either directly or indirectly, and documented in the policy. However, most successful energy hedging programs are managed by a risk management committee which is given the responsibility of overseeing the policy.

As an example, an oil and gas producer's risk management policy may state that between 35% and 80% of anticipated production (or perhaps PDP - proved, developed producing reserves) should, at any given time, be hedged for the no less than the prompt eighteen months. In addition, the committee can decide to extend the hedge positions up to forty-eight months into the future. The committee would then determine the appropriate instrument(s), tenor, and volumes (percent of anticipated production) will best position the company to meet their hedging goals and objectives.

On occasion, the policy and strategies may need to be adjusted due to a change in risk management objectives, overall corporate objectives and in some cases, changing market conditions, such as a sustained lack of liquidity in a specific market. 

4. Implementation

The risk management policy needs to be supported by controls, procedures, systems and reports which ensure the company's hedging activities receive an appropriate level of oversight. Proper controls, procedures, systems and reports should be implemented to provide the company's various stakeholders with a transparent view of how the company is managing it's energy commodity risk, on both a macro and micro level. 

5. Execution of Hedging Transactions

Once the previous steps have been addressed, it's time to execute the initial hedging transactions. For most companies, execution and management of hedges should be a dynamic process, as opposed to a static process. As such, existing and potential hedges should be constantly analyzed (i.e. weekly or monthly) to ensure that the company's positions are within the guidelines of the policy and are highly likely to allow the company to meet it's goals and objectives. In addition, the portfolio should be optimized, to reduce risk and/or improve pricing, if and/or when market conditions allow.

6. Monitoring, Analyzing and Reporting Risk

All relevant risks, both those which are being actively managed and those which are not, should be continuously monitored, quantified and reported through the company's energy risk management structure. As the company's risk exposure changes, there should be a systematic process for reporting such changes and determining, if the existing policy, as well as the accompanying strategies, processes, procedures and reports, remain fit for purpose. If not, the committee should take the appropriate actions.

7. Repeat

The "last" step is the most important: repeating the entire process as often as is prudent, regardless of whether it's as frequent as once a month or as infrequent once a year. While the formal energy risk management policy may only be modified, the remaining steps should be a constant, circular process, even if said process moves at the speed of a sloth.