Given below are some key risk factors for Oil and gas companies. You may want to include these KRI in your Operational Risk Management Framework.

Operational risk factors are the most specific to oil refiners:

- EHS risk (technical standard certification, regulatory audit score, record management reliability, # accidents, # near misses, environmental monitoring & measurement, % trained personnel, industry benchmarks, natural/terrorist risks assessment & mitigation)

- Supply-chain risk (# of suppliers, contract exposure, pipeline shutdown, vessels breakdown, delivery lead time, inventory levels, spoilage/theft, "flexibility to run any crude")

- Operating risk (capacity utilization, equipment aging, maintenance spend, planned vs unplanned downtime, industry benchmarks, regulatory oversight trends & drivers)

- Human risk (# training days, certification levels, staff turnover, management oversight process, crisis management contingency planning, management response to risk events)

Market and credit risks are fairly generic for any exchange trading activity:

- Commodity price risk (both oil price and "crack spread")

- Interest rate risk (both base and spread)

- Foreign exchange risk

- Liquidity risk (both funding and market/product liquidity)

- Counterparty risk (risk of default)

- Portfolio concentration risk

- Settlement risk (cost of carry, delivery time)

- Vertically integrated oil refiners have some natural hedging against those.

Business risk could be conceived around its familiar sections:

- Accounting risk (revenue recognition, earning at risk, capex accounting, inventory accounting, derivative/hedging accounting, accrual accounting)

- Legal/regulatory risk (warnings, fines, contingencies, "price gouging")

- Tax risk (capital vs ordinary income, timing & source of revenues, hedging transactions)

- Demand risk (economic growth, competitive pressure in trading area, demand elasticity, fuel/kerosene/gas consumption)