Risks
Alliander works hard to keep energy reliable, affordable and accessible for everyone. This work involves risks, including safety and financial risks. These risks cannot be entirely eliminated. However, risk management does provide insight into these risks, so that we can take informed decisions about these risks and risk management measures. In addition, risk management helps us refine Alliander’s strategy. Alliander uses a single risk management method. This ensures that the risk management process takes place in accordance with the same steps everywhere in the organisation.
Risk levels
Risks can be subdivided into five categories, ranging from very low to very high. The risk category depends on two factors: the probability of occurrence and the impact on the achievement of our strategic objectives. The potential impact on our objectives is assessed based on various aspects. Based on their probability and impact, each risk is assigned a place in the risk matrix.
Our main current risks
- ACompletion of work package ↑
- BCapacity for change →
- CSafety →
- DLong-term regulatory focus →
- EPrivacy →
- FFuture-proof IT landscape ↑
- GCybersecurity →
- HFinancing →
- IMeeting customers’ expectations →
- JFuture-proof investments →
Completion of work package ↑
Probability
Very high.
Impact
Very high.
What is the risk?
The volume of work, especially in the electricity domain, is increasing faster than anticipated due to the energy transition and economic growth. The shortage of technical staff in the labour market, lengthy training and volatility in the forecasts concerning the type and volume of work make timely scaling up of capacity challenging. In addition, we are seeing a scarcity of certain materials in the market and a shortage of space. The result is that an increasing proportion of the work cannot be executed and is being postponed, which in turn leads to climate goals not being achieved. The stepping up of these climate objectives means even more pressure. Certainly in the medium term – up to 2032 – it looks as though we still have a major task ahead of us to get all the work done.
How is the risk managed?
Alliander is addressing the challenge associated with completion of its work package by acting to prevent the need for more work, making better use of network capacity, generating a higher work output and developing an infrastructure for district heating and sustainable gases. To limit the amount of work required, we gain a better picture of the customer’s needs at an earlier stage and, together with stakeholders, we make plans for the future energy system. We prioritise the work where possible, and we develop smart solutions to ensure better utilisation of the available network capacity. Where possible, we form coalitions in the sector and the supply chain. We are making better use of the existing network capacity by applying smart solutions and encouraging customer flexibility. This reduces peak loads and enables more customers to be connected without expanding the grid. We can complete more work by focusing on early coordination with stakeholders, to shorten lead times for example. Furthermore, we are taking measures to recruit, train and retain technical personnel and to outsource work, and we are increasing productivity by simplifying, optimising and digitalising processes. Finally, we are developing infrastructure for district heating and sustainable gases that complements the work to maintain and expand the capacity for electricity.
What is the risk trend?
Rising. The 2023–2032 Multi-Year Plan shows that the work package is expected to increase further and thus remain at a challenging, high level. That, in combination with the scarcity of technical personnel, space and materials, significantly complicates realisation of the plan.
Capacity for change →
Probability
High.
Impact
High.
What is the risk?
The world around us is changing rapidly and the energy transition is in full swing. Our customers and society in general have high expectations of Alliander. Changes are needed if we are to continue to fulfil our social role. At the same time, we are dealing with an organisation in which employees are under pressure due to the challenges we face and uncertainty about whether and how we will be able to fulfil our task, certainly for the sake of our customers but also for each other. If we are unable to make the necessary changes, that could pose a threat to achieving our strategic goals.
How is the risk managed?
To increase the capacity for change, we are working on the basis of a common goal to create an agile, effective and cost-efficient organisation, a learning and high-performance organisation with a results-driven culture and the right leadership. This means addressing our strategy, our organisation and our culture and leadership. We work towards that common goal by adopting a clear strategy and making choices. Based on this strategy, critical success factors and performance indicators are defined for all levels of the organisation. We seek to have an agile, effective and cost-efficient organisation by being aware of each other’s production processes, continuing to develop the organisation structure and implementing a new Alliander consultative structure. We make use of strategic staff planning so that we can quickly and proactively respond to staffing developments in a much more targeted manner. Finally, we work on becoming a learning and high-performance organisation with a results-driven culture and the right leadership by developing activities that focus on professional skills, lasting personal effectiveness and inclusiveness.
What is the risk trend?
Neutral. The past year has been devoted to working on the basis of a common goal by making choices at the ‘strategic’ level and translating them into a roadmap and business plans. Action has also been taken in the areas of leadership and culture. At the same time, we face the challenges of an organisation in which employees are under increasing pressure and the need for change is growing.
Safety →
Probability
Medium/high.
Impact
High.
What is the risk?
As a network company, we are responsible for managing and expanding energy networks for electricity, gas, biogas and district heating. These activities involve health and safety risks for our employees, contractors, customers and local communities. There are two types of safety risk: the one is the possibility of employees being injured when working on or near the grids, and the other is the potential for explosions, fire, suffocation, short circuit or other accidents that can occur as a result of an asset failure. Despite all the measures, there always remains the risk of an accident occurring that results in death or injury, especially now when Alliander’s work package is increasing and we are working with less experienced staff and with new methods and technologies. The potential impact is huge.
How is the risk managed?
We lay the foundation for safety by working to ensure the safety of our networks and assets, working safely on the networks, and reinforcing our safety culture. We guarantee the safety of our grids by always making safety an integral part of the design and selection criteria when choosing new asset standards and in our calls for tenders. We evaluate incidents so that we can learn from them. We approach working safely on the grids by obtaining an understanding of the safety risks and translating the necessary measures into work instructions. We ensure that only qualified employees carry out the work. Managers supervise compliance with work instructions and the use of PPE by carrying out workplace inspections and safety observation rounds, among other measures. We also analyse incidents so that we can learn from them. Lastly, we seek to bolster the safety culture by discussing safe working practices in the workplace and learning from incidents. We do all of this with the aim of making safety an inherent part of our mindset and actions at work.
What is the risk trend?
Neutral. Safety was prominently on the agenda again in 2022. However, safety incidents are inherent to working with live cables and continue to occur.
Long-term regulatory focus →
Probability
High.
Impact
Very high.
What is the risk?
Policy and regulations within the energy domain have an impact on our activities and profitability. We notice a growing mismatch between policy, regulations and reality. This may affect our work in facilitating the energy transition and Alliander’s objectives.
How is the risk managed?
This risk is basically managed by building long-term constructive relationships with the legislator and the regulator. Together with the legislator and regulatory authority, we discuss developments that are important for Alliander and potential bottlenecks that Alliander may encounter in practice. In those discussions, we emphasise the importance of a reasonable return and sufficient financial scope to perform our statutory duties. In addition, we discuss what is necessary for us to perform our role and fulfil our responsibilities effectively, now and in the future. Furthermore, we actively make proposals for required adjustments to national and European laws and regulations. Where relevant, we address issues collectively with other network operators within Netbeheer Nederland (the association of energy network operators).
What is the risk trend?
Neutral. Action is being taken to manage this risk, but uncertainty remains. With the presentation of the National Network Congestion Action Plan, the policy goals for the energy transition in the Netherlands have been embraced more resolutely by a market- and government-wide coalition of stakeholders. Financially, the Framework Agreement for future capital contributions by the State is now in place (also called the Night Watch Project). The new Congestion Management Code Decree came into effect in October 2022. We are also looking at mitigating interim measures given the rising costs of congestion management and network losses. Exactly when the Energy Act will come into effect remains uncertain and delays continue to arise; this puts it out of step with the speed of the energy transition. and necessitates innovation (including new policymaking directly in consensus with the market).
Privacy →
Probability
Medium/high.
Impact
Low/medium.
What is the risk?
As part of our energy network management activities, we have access to personal data. This includes, for example, data on connections, energy contracts, usage and costs. This personal data must be processed in compliance with the requirements of the General Data Protection Regulation (GDPR). Unlawful or incorrect use of personal data harms the data subjects and it can lead to fines and damage our reputation.
How is the risk managed?
We work on raising privacy awareness by training employees. We have a privacy policy for the design, implementation, management, monitoring and continuous improvement of privacy. We keep track of which personal data is processed and for what purpose in data processing registers. We provide access control for application users and administer and manage users of our IT systems. We also practice Privacy by Design when designing new processes or making changes to existing ones. Furthermore, we safeguard privacy in our data processing agreements with suppliers. Lastly, we have a procedure for assessing data breaches and for reporting incidents, where necessary, to the data protection authority in a timely and correct manner.
What is the risk trend?
Neutral. Last year, action was taken to manage this risk. Nevertheless, lawful processing of personal data (customer data, metering data, HR data) remains an ongoing area of concern in view of the legal requirements (legal basis/purpose). This also applies to the technical and organisational measures taken to ensure appropriate protection of personal data.
Future-proof IT landscape ↑
Probability
Medium/high.
Impact
High.
What is the risk?
Alliander needs an integrated IT architecture to be able to accommodate current and future primary processes and enable the energy transition. What is more, the current IT landscape is complex, which complicates the digital transformation to a data-driven network operator.
How is the risk managed?
We are investing in the long-term development of our core systems: we are prioritising making a blueprint of them and drawing up plans to tackle them. Business processes must be standardised to allow migration to standard IT building blocks (Fit4Future component). All digitalisation takes place under architecture in the digitalisation ecosystem. We are also scaling up the digitalisation effort further. All digitalisation efforts are linked to strategic milestones in order to prioritise them appropriately. We are restructuring part of the Agile Release Trains (ARTs) to achieve better alignment with the interests of Alliander as a whole, rather than focusing on specific business units.
What is the risk trend?
Rising. Ever-increasing demand and the unavoidable need to scale up the IT landscape are leading to an increasing risk. Given the immense challenge Alliander faces in fulfilling its task, the demand for rapid virtual solutions is increasing.
Cybersecurity →
Probability
High.
Impact
High.
What is the risk?
Our energy networks and above-ground installations are increasingly being digitised. Cyberattacks with a political or terrorist motive are increasingly targeting vital infrastructure. In addition, geopolitical developments are leading to increased threat levels and require better protection of data and business processes. Disruptions to or outages of the digital infrastructure can lead to disruptions in daily life or even to a breakdown of society. The supply of electricity is inextricably bound up with this.
How is the risk managed?
The risk is managed through security by design, the information security management system, business continuity management and through appropriate definition and measurability of security processes. In all digitalisation initiatives, whether they involve self-build or purchased products and services, security by design is applied for optimal assurance of security. We implement an Alliander-wide information security management system to manage security within Alliander consistently and keep it up to date in a dynamic world. We facilitate business continuity management to minimise the impact of an emergency on business processes: i.e. we prepare for an emergency to the greatest possible extent and know what to do during and after an emergency. We set ourselves targets in terms of security maturity and the corresponding definition and measurability of processes and measures.
What is the risk trend?
Neutral. Given the external developments (Ukraine, increase in cyber attacks on organisations), the risk trend is unchanged despite the control measures that have been deployed.
Financing →
Probability
Medium.
Impact
Medium.
What is the risk?
As the Climate Agreement was further fleshed out, greater clarity was created on the level of investment needed for the energy transition. Network operators will see their investments increase considerably. Current regulatory methods provide for compensation during the service life of the asset in which an investment has been made, but not at the time of making the investment. We are largely financing investments that we will only be able to recoup over the course of 40 years. The increase in investments brings with it a significant increase in our financing needs that may, in the long run, put pressure on our financial ratios and our credit rating.
How is the risk managed?
Alliander has taken various steps to be able to meet future financial challenges. For example, Alliander continues to work on becoming a cost-conscious and efficient organisation and it focuses constantly on maintaining a healthy financial position by strengthening equity. However, additional capital is needed to fulfil our future investment tasks, despite the convertible bond loan that has already been arranged. Alliander, Enexis and Stedin have reached agreements with the State on a possible capital contribution in exchange for a shareholding by the State in the network companies. This is an important step in fulfilling Alliander’s financing task. In addition to strengthening equity, we continue to work on a cost-conscious and efficient organisation in view of our investment task. The goal is to increase production and reduce organisational costs.
What is the risk trend?
Decreasing. In the past six months, good progress has been made towards structural control of this risk through the Framework Agreement for future capital contributions by the State.
Meeting customers’ expectations →
Probability
Very high.
Impact
Very high.
What is the risk?
It is becoming increasingly difficult to meet customers’ expectations. The shortage of transmission capacity is worsening and waiting periods for connections are getting longer. Interaction with customers is increasing too. All this has an impact on our customers and requires good, timely personal communication. At the same time, our customers have ever higher expectations concerning transparency and service provision. Consumers are uniting on specific topics and social and conventional media magnify issues. National and regional media are focusing more attention on network operators as well. This can cause customers to regard Alliander less positively, reducing public support for our work as a network operator.
How is the risk managed?
We are seeking to influence the image of our performance by aiming to act before incidents happen. We are introducing guidelines on communicating with people who live in the surrounding area, and on customer policy. Our contractors will also have to comply with these guidelines. Our communication strategy is proactive, timely and transparent and shows what action the customer can take. We take a regional and customer-specific approach through various channels, with focal points per topic such as the shortage of transmission capacity, waiting times for connections, the shortage of low-voltage electricity and the image of our day-to-day work. In the fourth quarter of 2022, we launched the vision on our customer service programme in which the organisation, as a Multidisciplinary Team (MDT), works to build a unified customer view that allows us to better serve customers. The goal is to give customers answers to their questions and provide information about the communication history for individual customers through one central customer system.
What is the risk trend?
Despite the control measures that have been put in place, this risk shows a neutral trend: customer service (for both large and small consumers) is increasingly under pressure due to increasing connection times and transmission shortages for the high-voltage, medium-voltage and low-voltage supply.
Future-proof investments →
Probability
High.
Impact
Very high.
What is the risk?
We are building an energy infrastructure to last some 40 years. At the same time, we are dealing with an environment in which political and other choices are made which encourage developments under current market conditions leading to an energy solution that is not appropriate from the perspective of the ideal system in the long term. This may lead to suboptimal investments which will not be fully utilised up to the end of their useful lives, duplicate infrastructures and therefore higher costs for the infrastructure and for society. It can also lead to a greater challenge in terms of the task feasibility and delays in achieving the goals of the energy transition.
How is the risk managed?
In line with our obligation in this regard, we connect customers to the electricity grid when they put in a request to that effect. We talk to customers to discuss the reason for the request and to offer them alternatives. The many investments for sustainable generation and the sites where generation infrastructure is placed for 20 years also pose a risk. Possible changes in political choices may result in the infrastructure for this renewable generation capability simply lying idle in the ground. In the short term, we produce quantitative information on which areas require investment over the next 20 years. We use this information as input for our local and national lobbying efforts to put the issue on the agenda and ensure that conscious political choices are made, so that the consequences can be managed. We are also conducting discussions in the relevant regions to get the problem on the agenda.
What is the risk trend?
Neutral. Despite the control measures put in place, this risk shows a neutral trend. In accordance with our task as a network operator, we connect customers to the electricity network where a request is made and we upgrade the networks in places where we expect many customer requests: this can lead to suboptimal investments that are not fully exploited during their useful life.
Risk awareness
The management of risks forms part of our governance and decision-making. The Management Board and Supervisory Board of Alliander regularly discuss the principal risks. They assess what effects the risks can have on the strategic objectives, the operations and our reputation.
Alliander is committed to complying with the guidelines in the (revised) Corporate Governance Code. In the ‘Corporate governance’, ‘Statement by the Management Board’ and ‘Other information’ sections, we provide more information on how risk management has explicitly been embedded in the organisation’s governance and decision-making procedures. For more general information about risk management, go to www.alliander.com.
Risk appetite
To achieve the corporate objectives, we sometimes need to accept risks to a certain extent. The extent to which we are prepared to run risk in attaining our goals (i.e. our ‘risk appetite’) ranges from risk to risk.
When it comes to the safety of our employees, our customers and our networks, we take no risk whatsoever. All risks are excluded, where possible and realistic.
Our risk appetite is low when it comes to compliance. We are expected to comply with laws and regulations and are committed to acting in accordance with internal procedures and the Alliander Code of Conduct.
Where strategic risks are concerned, we seek the right balance between the risks and our longer-term ambitions.
We have a low appetite for financial risks. This ensures that we have a healthy financial basis and meet our key financial ratios.
Explanation of risks
The following provides details of each risk and how Alliander manages each of the risks listed, while also showing the development in each area over the past year in light of measures taken.
The risk designations A to J in the matrix above are interactive. Clicking them produces an explanation of the relevant risk and details of how Alliander manages the risk. while also showing the development in each area over the past year in light of measures taken.
decreasing: ↓
neutral: →
increasing: ↑
Financial risks, including our credit risk, are explained in note 34 to the financial statements.