Corporate Security

An unstable geopolitical environment in 2023 combined with complex new and ongoing regional conflicts, not only in the Middle East but also in Europe, resulted in Corporate Security continuing to invest significant resources in ensuring resilience and security in areas that we had previously considered low risk, but without losing focus on our employees and assets in the Middle East and North Africa. In addition to the challenges of operating securely in Yemen, Tunisia, and Libya, the enduring threat of terrorist attacks in Europe and elsewhere has not diminished. Political extremism, organized crime, and the increasing convergence of cyber risks with physical threats necessi­tated the Corporate Security department’s unrelenting focus on a robust yet flexible security strategy to enable OMV to continue operating in dynamic environments with asymmetric threats.

Specific Policies and Commitments

The OMV Group’s internal Security Management Standard lays out a comprehensive range of security regulations, plans, procedures, measures, and systems. The document utilizes the IOGP best practice guidelines, along with other industry best practice (ASIS and UK Security Institute), to enable the OMV Group to more effectively detect, deter, protect against, prevent, record, and investigate threats. Corporate guidelines on Issue Motivated Groups (IMGs) were updated, as was a position paper on Unmanned Aerial Systems (UASs).

Management and Due Diligence Processes

The OMV Group has a unique, agile, and proven security management system that is regularly reviewed, amended, or enhanced as the situation requires.

Risk Assessments

The philosophy of collecting security information and assessing it as a preventive security instrument remains a fundamental principle of the Corporate Security strategy. This concept affords us the ability to anticipate or instantly respond to a broad spectrum of geopolitical events, regional conflicts, and isolated incidents. Effective interaction with government and local security agencies further augments this approach with the reliable corroboration of facts on the ground.

OMV’s security risk assessment platform continues to provide real-time oversight of OMV’s asset risk exposure levels and can be quickly adjusted in response to geopolitical or security events, as well as enabling the dissemination of security-critical information in real time.

Human Rights and Community Engagement

The OMV Group’s human rights policies and actions remain crucial to guaranteeing a secure and harmonious working environment. We provide human rights training to local security employees and third-party contractors. Effective community engagement at a local level remains a powerful security mitigation measure in regions experiencing conflict or instability. In high-risk countries, OMV’s local security and community engagement strategies are tightly integrated, promoting effective policies, mutual respect, and transparency with all local stakeholders. In turn, they contributed directly to OMV’s stable and secure operating environment in 2023. This cooperation encourages a precautionary approach to early detection and resolution of local grievances.

Audits

To ensure the effectiveness and appropriateness of security practices within OMV’s business units, the OMV Corporate Security function conducts audits every year for those ventures deemed high risk (for 2023 this was Libya, Tunisia, and Yemen). Two other major audits are conducted annually, with business units being chosen based on operational requirements. In 2023, the selected areas were OMV NZ and the OMV DE Burghausen refinery and associated Tank Farms.

Terms of Reference are agreed with the business unit prior to commencing the audit. A thorough review then takes place including site visits, interviews, document analysis, and observations. An audit report is then drafted, shared, agreed, and published. The report will include SMART actions, with the entire process being tracked via OMV’s HSSE tool Synergi.

Resilience

In the OMV Group, the term “resilience” covers incident, emergency, crisis, and business continuity management and, even though the Resilience function sits within the Group Security & Resilience department, the focus is not exclusively on security incidents. It covers all sorts of events involving people, environment, assets, information, and reputation, where the OMV Group has legal, ethical, or community responsibilities, or business interests.

According to the Group-wide Resilience Standard, the OMV Group uses a three-tier approach for the management of incidents, emergencies, and crises by way of dedicated teams at different levels of the organization (Incident Management Teams, Emergency Management Teams, Crisis Management Teams). The key priorities in any such situation are to:

• Protect and save life through a strong focus on the ability to account for people
• Minimize damage to the environment
• Protect assets and information from further damage
• Minimize business interruptions
• Minimize financial and legal liability
• Protect or enhance reputation

In order to maintain a high level of preparedness, the incident, emergency, and crisis management plans and procedures are tested and the respective team members trained and exercised at regular intervals.

2023 Actions

The Corporate Security department continued to deliver operational support to OMV ventures globally, as well as surge capacity during security challenges. In high-risk countries, OMV also utilized dedicated Country Security Managers and Asset Protection Experts on site to enhance security via additional and, where appropriate, local expertise.

In 2021, the OMV Executive Board took the decision that OMV would join the Voluntary Principles on Security and Human Rights (VPSHR), if feasible. This set of tools provides guidance on risk assessment, public safety and security, human rights abuses, and the interaction between companies and private and public security. OMV is committed to upholding human rights in all of its activities. In 2023, OMV Corporate Security completed its application to VPSHR and attended its annual conference in London. OMV is currently awaiting the results of its application.

Outlook

OMV will continue its engagement with the VPSHR initiative and aims to become a dedicated member.