Assets CollABorative April 2024 Session

IFS Assets CollABorative: Think Tank - Regulatory Compliance with Jon Mortensen, Global CTO EAM at IFS

Date of Meeting: 18 April 2024 10:00 AM US Eastern Standard Time

Jon Mortensen Presentation:

Slide: IFS CollABorative Asset Management March 2024

• As Global CTO, I'm responsible in many ways for the strategic direction of the IFS cloud EAM solution, but I'm also suffering from scope creep. Which means essentially I am looking at everything that has to do with asset centric across not just IFS Cloud but some of the solutions that we have procured to compliment IFS Cloud and one day hopefully will be folded into IFS Cloud as well. So, from that perspective, I'm always going to be interested in what people are doing with the product in particular, what people want to do with the product, which is probably more important than what people are doing with the product, and I'm interested in particular in the use cases that are being evolved to be used in the product and workarounds that people are doing when they need to work around because we don't address it directly. I will never know if there's issues with the solution if I don't have those sorts of conversations. And we can only improve by having those sorts of conversations. I've been on board here at IFS since November 2022, so just over 15 months now. I'm getting a good grasp of the product. I have been in the asset management space for approximately 35 years. Typically, from the perspective of software. Though my background I am a geomechanical engineer. So anything you want to know about slow moving tectonic plates on your guy and I have a masters in geographical information systems. So it's no surprise that one of the first things I want to get sorted out around here is GIS capabilities, particularly for our utilities and our mining customers.

Slide: EAM Business Benefits

• When we talk about enterprise asset management, we always consider that there's five core benefits to the EAM brings to the table, increase revenue and margin, optimise use of capital, ensure safety and well-being, manage risk and achieve net zero, which is pretty close to where you guys are having to go with regulation in the European Union, and avoid regulatory non compliance. But when we look at these topics, the one that we never actually discuss is the regulatory compliance one. We always revert ourselves back to money, capital, health, safety and those sorts of things.

Slide: Word Graph

• But last year I ran a survey across probably about 120 companies and I asked them to list out the key things that worried them in their day-to-day life, and I turned it into a word graph because this sort of gives you a scalability of what those are, and right across the middle of it with regulation and everything to do with regulatory compliance. And it sort of blew out of the water, even things like cut CapEx and OpEx and safety. And I found that fascinating because to me, regulatory compliance has always been a side effect of your software, rather than being the main driver behind it.

Slide: Regulatory Compliance Definition

• And so when I spin back and start thinking about regulatory compliance, I start saying, well, what is it? What is the definition of that? And when I search out definitions, there is a lot and it tends to always focus on financials. But Gartner comes up with a very, very simple definition and for that reason I tend to stick with it, because to me, if I can boil something down to a really, really simple statement, it makes a life a lot easier. And it really is regulatory compliance is concerned with laws that a business must obey or risk legal sanctions up to and including prison for its officers. And that to me becomes very, very, very scary because it covers so many different things that we might not be aware of.

Slide: Regulatory Compliance – Asset Management Point of View

• So when I think about regulatory compliance. I do put it into six buckets. And I'll be interested to know from you guys whether there's extra buckets that I should be thinking about. But the big one that most people think about is financial compliance, and we have a lot of laws and a lot of different countries about that. But Sarbanes-Oxley in the US and the international financial reporting standards do come to mind for that. Data protection and privacy. This is huge, particularly in Europe and California. We have GDPR in Europe and we have CCPA in California, which is really around about the right to be forgotten and for us in the asset management space that becomes really complicated because we have got conflicting requirements in terms of regulatory compliance because particularly in health and safety, we have to record a lot of information in regards to who did what, where and when. And when we think about those sorts of things, making sure that what you set up within a solution like IFS Cloud is making sure that we don't lose those other things that we're required to do from regulatory compliance position in addition to that right to be forgotten, which permeates through GDPR and through CCPA. Then we get into those industry specific regulations and these are regulations which come through each of the vertical. So as a company we focus on six major verticals and then underneath that there's 28 sub verticals that we focus on. And for each one of those, we have to look at what are the specific regulations for that particular vertical. So again, when we look at these different industries, we have FERC reporting in the US for the utility industry. We have FDA 21 CFR Part 11, which is for anybody using pharmaceutical manufacturing who wants to sell in the United States. RC8 for food traceability in the UK, but that's used in over 50 different countries who rely on that for controlling those things. And then you've got an enormous number of things that come off the back of that one waste management, pollution control, sustainable practises, carbon reduction, et cetera.
• Then we have the environmental compliance. Part of what we're developing at the moment across the board and we'll be talking about next month is collecting the data that's required to support that and how to use it to leverage your asset management practises, etcetera. Which is a tie up between those. Whether and I don't know the answer to this question whether that covers off on any of the environmental laws. I do not know, and the particular compliance requirements that you have there, but what we have done in that area is being able to collect our scope 1 and recall them, scope 2 emissions and scope 3.
• And I'm not sure if we got all the way through scope 3 yet, but scope 3 is missions other people make on your behalf, so your suppliers, et cetera. And where at all possible we are starting to build out the adapters to be able to collect that information. And if you've got ways of actually consuming that information from devices that you might be using. So scope 1 are emissions you make on your own behalf when you're creating energy. Scope 2 is the emissions that you make, which somebody else generates on your behalf. So, if you're consuming that from somewhere else, so typically that would be the electricity grid. You consumer from the electricity grid, you're not making the carbon emissions, but you're consuming the product that does, and then the third one is, is outside of your ambit, but is knowing what other people are doing. So next month, there probably be a lot more information on that one.
• The third bucket, which becomes really important, the labour laws and employment regulations, which for the industry you're both in can be incredibly strict. And safety becomes paramount. And if you don't do all the things that are required for safety, you can come up with some quite big incidences and I'm not going to throw in BP in the Mexico golf at the moment as an example of what happens when you don't do that properly.
• And then finally, there's security compliance, the software. And compliance with ISO 27001 for information security, the NIST 6 Cybersecurity framework and things like that, and I'm going to talk a little bit more about that momentarily.

Slide: Benefits of regulatory compliance

• Because I deal a lot with the US, where a lot of people don't think regulation is really important, and they feel it's cheaper to pay a fine than to actually comply. Then get a shock when it's not. I'd like to talk about the benefits of regulatory compliance from an asset management point of view. So, the first one I always think that a lot of these regulatory compliance obligations actually come with a framework that's associated with them, and you'll get that with the environmental stuff as well. And they tend to start making you structure your thought and business processes around that compliance and that makes you start having to look at best practises and standardised practises. And they have a tendency to lead to operational efficiencies, streamline workflows and improve cost savings.
• The key one for me is something known as demonstrable compliance, which didn't fit in my little box there, so I renamed it auditability. And auditability is really key and often you don't need to do things up front. Now for the environmental compliance, this will be something that you will need to report on, on a regular basis at a particular time. But sooner or later somebody's going to come back and say can you prove it? And that's where having a system of record becomes really, really important. And structuring an asset management system for safety, management for environmental reporting and all of those sorts of things becomes critical because of that need, putting that auditability in, so after an accident, you can go back and say this is what happened. This is the maintenance I did on that. This is the hazards and precautions that I was using within the system and the management of those permit to work processes, et cetera. That's what I've been doing in my solution and here is the traceability for how I've gone through that. So, when we look at this from an accident, I've done everything that I need to do, and I can prove it. And that proof is itself a saving grace. It helps in a legal situation. It helps in a financial fine situation. It helps to be able to see that you have done what you needed to do and you can prove the numbers that you provide to those regulatory authorities for things like the environmental reporting side of things.
• And that also leads to enhanced reputation, because when you start recording these and have that auditability, it gives you the ability to be able to talk about it to the market in general. I did a podcast this morning called on the rocks. It's now available on our website to go through, but it's for the mining industry. And one of the things I talked about in the mining industry was that people are doing all the right things when it comes to tracking and auditing their environmental credentials, but they don't do anything about explaining to the public at large who sees them as the big bad meanies, of what they are doing because everybody is working really hard to achieve these, but there is a PR exercise, and it's got to be provable that can come out the back end of it. And if you can get that balance right, enhancing the reputation really becomes an output that comes with that.
• Reduce risk. That one probably stands on its own. I'm Australian, so I always think of swimming between the flags, which is why I've got that particular image there. It provides the guidelines of where you can go, which is safer, and everything outside of that you're doing at your own risk. And by complying and following compliance process, the ability to reduce risk becomes really strong. So again, compliance helps identify and mitigate potential risks such as data breaches, fraud, environmental liabilities, operational disruptions, but it also leads to better risk management practises and one of the things that we're trying to develop into the solution. We'll be putting a lot more investment into risk management, ISO 31000 moving forward is being able to have compliance with those sorts of standards, which will help also work with regulatory compliance that comes around to it, because again it's all about demonstrability that comes out of that.
• Competitive advantage is if your competitors are not doing this stuff and making your song and dance about it and you are, you get that sort of advantage out of the back end.

Slide: Planning for Compliance through Software

• So, what do we do in a software sense to help with compliance? There's four buckets that I put in this particular area.
• One is the built in functions. So, when there's a universal or structural requirement, these are typically designed and architected into the solution. So, 27001 one for security, for example, built right into the cloud platform. It becomes important that if everybody has to do it, that that we actually create that as part of the solution for doing it. And hence when we start talking about environmental compliance and environmental reporting, whilst the reporting requirements in different jurisdictions is going to be different in how you present that back, it's fundamentally it's going global. So being able to do the process to get the accounting in place, and having the areas for storing that information becomes paramount in what we do moving forward in this particular area. So, we're investing in the product for those universal things, and then the reporting side of it that comes out the back end is something that becomes more jurisdictionally, is how do we need to structure it in implementation or in a geography to make sure that reporting is appropriate for that area.
• Then we look at things through industry. Is it one of our major industries that we invest in? Should we be investing in the particular regulatory compliances for a specific industry? Are those industry compliance requirements global in nature? So, it doesn't matter what your industry is, is it something that you still have to report on in every jurisdiction? Or is it like the third requirements for electrical distribution in the US, which is very, very narrow but actually requires a lot of behind the scenes work. And we have to make as a company a call by industry, by geography, and what we build into the solution or what we make available in the solution that can be configured in implementation to make that work.
• And then the other side of that is business process. When you go through these compliance activities and you have to create compliance, and we have to help build in or configure to meet those compliance requirements, we also have to understand how we're going to collect that data, where is it going to come from? What is the business process behind bringing that data in? And where do I place that to make it auditable in a structured way? So, part of doing this is do we set down this is how we're going to design the business process for collecting it? Do we provide flexibility in how we collect things, but provide the storage space for that being and how flexible do we need to be in the direction for that? So as part of the consideration you go through when you build this. Pulling together a bunch of customers in a particular area and saying what is the optimal process for doing this or is it. here it is, we provide a bunch of APIs, go for it and work out how you're going to do it yourself. And that again is part of the balancing act.
• For the environmental one we started with building the repository. We know where things are going to end up. We know the calculations we need to get there. Now the decision is, how do we get the information in? Do we think of it through business process terms and that is people going manually collecting this stuff and we have to make sure that they do things in a certain format so it all flows through and translates, or do we at that front end say let's connect into systems wherever possible and automate that transformation process, which is the decision we've taken to do with our greenhouse gas accounting, is to make it as simple as possible, to get the information in because that provides the level of auditability that we believe that customers will be obliged to be able to prove further down the track.
• And the final thing is reporting. What is it that we require to provide in terms of reporting? And considering the number of countries we deal in, the number of jurisdictions we are, we'll often say as part of the implementation for your geography, you need to report in this format and we tend to find that partners and our own GCS will build out for the regions that they work in, the reporting that they need to have their repository rather than putting it into the solution itself. But there are times where a particular industry needs a certain level of certification, and there's a auditory body that is prepared to say we will certify or approve your product as a product, we can go into knowing that it collects what we need. So DNV is one of those. We've just had it certified for IFS Cloud. Which enables any information that's taken from our system to meet their requirements. They have that access too. But we also have to look at different authorities who say we want a particular XML format. We want you to extract that and upload an XML format. We have other authorities and I dealt with this one about three years ago, who say you have to type everything into our system. That's a transit industry in the US, and it takes 15 people 8 hours a day, five days a week to get that information in, which is just ridiculous. Whereas if you're in Australia, which is where I come from, we collect everything in XML format, so all you have to do is make sure the system can push out an XML format file that does that. Other people want written ones. It's a big exercise. We try to simplify it as much as we can. We do rely on local GCS and partners to localise that. But when we start looking at it from a broader perspective, knowing that these different methodologies that we can make use of, it becomes easier to do that uplift that goes with that.

Slide: Managing Regulatory Compliance

• There is another aspect that we need to be aware of in managing regulatory compliance and I look at this as again from the asset management point of view, what do we need to do to actually implement this at a customer end. So, what does the customer need to do? And first of all is actually understand what those applicable regulations are. But we provided the means and the ability to comply, we aren’t the certification authority and a lot of these things require business process and things that are external to the system to be in place as well. So, understanding identifying and understanding specific regulations that you want, coupled with your software is actually quite important. And understanding why it makes sense to use your operational system to meet those regulations is also important. So, in terms of the environmental one, it does make perfect sense to collect it in the system. But there are a lot of things that you have to balance up. What am I expecting of the system? And then once I have that, I need to look at the software I've got itself and look at how I can hit that compliance with the solution. Does the solution itself have it? So you can either do that with your vendor, or get somebody to do it independent for you. And clearly identify if it should be core to the solution that you're doing.
• Documenting policies and procedures, those policies and procedures, and how we actually go about doing things, and how it ties back to those regulations needs to be done independent of the software in the first one. So understanding how you want to do something? Documenting that, and then working towards how do I do that with the system, and then that will inform the business processes that you're going through. And because there's people involved in all of these processes, we try to remove people from the equation as much as possible, but there will always be people in the equation. Once those policies and procedures are in point of view, once we know how we're doing it with the software we've got, then we've got a look at the training side of things to make sure that people know what they have to do. They have to be aware of their of what they need to do in their day-to-day work, independent of the system as well as what they need to do in terms of the system itself. So that training and awareness component is really, really important. And I can't say how many times over the years, that people don't do that bit because the system does it. And it's fine that the system does it, but if you don't have the people aspect associated with it and people understanding why they're doing things, they take shortcuts. They leave stuff out because it's just too hard and then flowing all of this up no longer makes sense to it, and you lose in auditability, which was really important beforehand.
• And that brings me to the next one, which is regular audits and reviews. All of these regulations change more quickly than the software company like us can ever keep up with totally, so it is contingent upon everybody keeping a regular audit of what's required in their industry, of being able to review those changes, what those changes are impacting on their way of their system. So, it's sort of like this unending loop of having to go back and check with what's happening.
• And of course, maintaining documentation of records of why you made the decisions you did to do things the way you were doing them, to collect records on what it is you're doing, and what the results of those are, those records can be the electronic records which is stored within the system when you're relying on the system 100% to do it. But when there is stuff that takes place outside of the system, it needs to be recorded, documented and linked back to the system in some way so that there is a traceability for it. And the one that I tend to use is in the legal sense where we'll go through a compliance activity. We'll talk to a regulator. The regulator will talk to us and will tell us what to do and then we store all that information in the legal department. And so, when we get back to maintenance and asset management, we don't have that documentation because it's stored in the legal department somewhere and we have to make sure, even if it's stored in the legal department, we have access to it from our side, because we're not going to be able to change what we do if we don't have that as part of our decision making process that we have within the application.
• That covers what I was going to talk about from a procedural and from a conceptual point of view of regulatory compliance.

Questions / Answers / Feedback / Responses:

• Q: Currently we are working in IFS 10. And we are planning our journey to cloud, which will be quite far in the future but, but of course what we would like is better support for oil and gas. In cloud and a solution, how we could avoid replication? Possibly in a combination with Star Link. Or a similar solutions with reduced data usage.
• A: It makes a lot of sense because in 24R1 we've completed the move of all the extensions across to IFS Cloud and our thoughts are that where we want people to go, is to use systems like Starlink rather than trying to do replication because replication, when it was designed was a very tight number of things that were being replicated offline. And people want to keep extending that and extending that and IFS itself just won't scale like that. So to be able to use things like Starlink and get the sorts of speeds they're getting. I live in Vancouver and British Columbia, but our property that we have in Australia, as you can tell from the accent, we use Starlink and it's actually faster than what we get through the copper wires that come out to the property. So quite excited about that as well.

• Q: How would you export this information? In our business, we have to collect all the metre values for example, and you can connect that to the functional objects in EAM. How would you get that to some kind of standard format for reporting in the European Union, for example, what would the solution look like?
• A: So if I'm thinking about where we go from there is, first of all, are you using smart metres who are able to talk or are they things that people need to go through and read?
• R: No, it's automated. We have a flow metres, for example, for some like chemicals and the banker oil and stuff, but not for all chemicals, of course used. They have lots of chemicals for example, for toilets and stuff, but there are no metering.
• A: So the philosophy that sits behind that is that we bring in those raw readings. You have to match those against what it is that's in the pipe or what it is that we're measuring and the unit of measure that is because one of the things that you've got to do is take what the mix is that makes that up, and put it through the conversion factor to take it to carbon equivalents. So when we talk about CO 2 equivalency, you can get some chemicals. This is really huge in the utility industry with sulphur hexafluoride, which has got a really, really, really heavy base, 3200 kilograms I think it is. And 1 kilogram me of that equals 3200 kilograms of carbon equivalency. So, you've got to know what the make up is that sits within that and do that conversion and that process is where we end up with the standardisation of the measurement. So going from whatever it is, we've got fair understanding what the mix is. So, you need to know what it is that those emissions make up and move across. Collecting that sometime is difficult in the flaring situation. Trying to work out what it is you're flaring, it depends on the technology you're using to do that sort of thing. We have some other products within our portfolio that actually help try to break down what those flare profiles look like. I do have a presentation I did in Dubai last year on being able to do those sorts of translations and again, I'll see if I can dig it up and let you have a look at it as well. It is a standardisation process. It is essentially calculation, and it is essentially trying to work out, and this is the hardest bit, what is it I need to measure what is the composition of that so we get that translation figure. But it is a process for doing that. How we slot all that in is a good question for next month, but that is the philosophy that we're taking is either taking the measures manually or through automated SCADA feeds or PLCs or whatever it is that we've got as the translation device. If it's going through a historian that does make it easier. And taking that into the solution, doing the math and then placing that into the essentially accounting package that they're building out for carbon emissions.
• Q: So it's not as simple as translation table for different substances where we can have for each substance the carbon equivalents?  Is it a total package we need to do this?
• A: Well, we're building it out and where we are in that stage, I don't know, but the calculations etcetera that go with it, because we get some things where you've got 5, 6, 7, 8, 9, 10 different greenhouse gases being put into or as an output from that same thing that you're measuring, and being able to say what that mix is. I've got 40% benzene, 20% methane, whatever it is. That is really what we have to do is break it down into the componentry parts for the different weights and it has to be done somewhere.
• Q: What we also have, is that since we are using helicopters as well and we have to report usage of fuel for those helicopters, and they are of course not part of our equipment structure. So that is also something we are not sure how we will get those figures. We don’t own the helicopters, but we are using them and we need to take that into account. Scope 3 I think you called it?
• A: Yes Scope 3. I I've been playing with this for almost 20 years. I wrote a carbon accounting package in 2007 I think it was, to try to work this stuff out because the reporting regimes in a lot of countries have been around for a long time, but nobody's actually done anything with them. And as these regulations start coming through, that sort of thing comes more and more to the four. Do provide estimates at the moment to authorities?
• Q: Yes, we do. But they're not so strict yet in the format we report, but we have information that they will be stricter. So we need to figure it out, but we have no requirement regarding format yet. We just have to report the figures, but we know that it will be standardized. We wonder if you have more information, if there is some kind of standard?
• A: So for me, for the for the European requirements, I don't personally. But again, this is one of the reasons Sarah's organised the Sustainability Officer, because we have we've actually created a VP who's just responsible for this stuff, reporting to Mark Moffett and we've been doing a lot of development over the last three years on actually starting to bring this stuff together, so she will probably she will probably take us down into the weeds of the reporting aspect of it and the storage side of that. So, bringing all these things together are important, but the key thing is this ability that we're working on to be able to bring the information directly through the assets to get it there. We started off with the ability to manually enter it and that will remain moving forward because not everybody has these things in an automated system, automation just makes it easier at the end of the day until you get to things like, if you're filling up fuel from somewhere that that you don't have access to a system to do, will have to go through.

• Q: Working offshore, it's a problem with the training. Having a lot of training in the procedures cost a huge amount of money. We have 3 shifts each day, and you have to cover everyone. And when they go off after assignment and they begin new teams. It's an issue to keep people up to date with regulations. What to think about, how do you report or for example, what is the procedure for maintenance for a certain engine for it to become approved by DMV and the audits, for example. How do you transfer knowledge when it's so much details in a in an efficient manner, because this will affect more than just the HSEQ personnel in the future. How do you transfer this knowledge in this simple way?
• A: There are three ways that I look at when it when it comes through here. When it comes to the overall arch and concepts, I tend to think that has to be done in person or as a group for the conceptual level. The next level down I look at is learning management systems. So we ourselves use Academy to train people on how to do various things within the solution, but using a learning management system about how to do things means that you can have people do that without having to gather them all together. And make it available for them and then you provide a window of you've got three months, can you make sure that you cover these off? The last one is a new area that we're playing with, which is copilot. So, in a 24 hour one release, we're doing the first release of a copilot for IFS Cloud. And in that first component of copilot, we're providing access to documentation. Everybody will tell me this is the one message I've heard in the 15 months I've been here. Is John your documentation is terrible. We can't work out how to do anything in IFS. So, what we've actually done is we've gathered all the documentation available for us, and we've run a large language model over it. And so when somebody is in the solution and this is only on the cloud based solution at the moment, from 24R1, is to ask how do I do XYZ or what do I have to do for XYZ? It will actually come back and say these are the steps that we recommend you do, and this is the documentation that you've got within the system. Here are the links for you to go and see. The second phase of doing that is your standard operating procedures. If you store those within the solution, then copilot will bring those into the model. So, when you start saying how do I do XYZ? What is my standard operating procedure for XYZ. It will be able to pull that out for you and present it to you. So the core thing there is that often when you set up tasks against work, et cetera, you put down these are the steps you have to go through, but you have to really churn through the solution together. The number of clicks is incredible. But if you've got copilot there and you can ask copilot that question and it pulls back that information for you, you've reduced almost exclusively all the clicks that you would have had to do to get that information out of the system. So, it'll bring it to the fore and again it will provide the links back to the documentation that's associated with it. So that's where we're going with that. That should from a training perspective, probably not help training per se, but it's going to enable people to do things more effectively because if there's a compliance component to that, it needs to come out through that process on Co pilot as well. Does that help?
• R: Yes, that would help a lot because it's difficult for them to find the correct information. A lot of data is has been migrated from another store. It's an old system we used previously before IFS. And it's very much simpler than the IFS, so they really struggled for sure. Finding what how to work with the system, they find their own ways and everyone tries it. They find how to solve things. They get stuck with that and they think it's terrible because they think that's the way to do it. But in IFS you can do things in so many ways and offer much more efficient than what they found out. So, helping them in some way, supporting them while their work would help a lot.
• F: So, copilot is going to be a game changer for us in that space. As I said, 24R1 is our first release of that. Just getting through our documentation. We are intending to in 24R2 do your documentation as well. And then we're intending to in 25R1 making that available on mobile. But what we won't be able to do on mobile, is do that in an offline mode because you're going back through the whole repository for the large language model, and that's what they're grappling with at the moment. There is a plan and we're executing on it. That's probably the main thing to say though.
• R: That will be a problem with not having offline support because we can't never have full network on our platforms because there is a lot of metal. So that would be an issue for us to use that feature.

Reliability Leadership Experience

• We are hosting reliability workshops around the world in 2024.
• June 17 in Amsterdam. July 11 in Washington DC. July 19 in Chicago IL and September 18 in Houston TX.
• I just wanted to make you guys aware that we're doing this. So, if you're interested in reliability workshops, it's led by Reliability Web, who has about 20,000 members. And they do a certification process for reliability as well. If it's of interest to you, please contact jon.mortensen@ifs.com

Next Meeting: 13 May 2024 10:00 AM US Eastern Standard Time / 15:00 BST / 16:00 CEST
IFS Combined CollABorative: Tech Talk Session – IFS x Sustainability 

If you are an IFS Customer and you do not have the next meeting invitation to this CollABorative and would like to join, please click here to fill out the form.