30-Session Programme · 25 Minutes Per Day · Free · For leaders in Nigeria’s oil and gas sector
WEEK 4 OF 6 · GAS, THE DOWNSTREAM AND OPERATIONAL TRUST · SESSIONS 16–20 · WORK AT YOUR OWN PACE
Part Four · Gas and the DownstreamSESSION 16
The Decade of Gas
Why This Matters
Gas is where the book's discipline is tested hardest. A barrel can sit in a tank; a gas molecule cannot. It must be processed, compressed, moved through connected infrastructure and delivered against a contract, or it is flared, reinjected or stranded. The book's claim is precise: the constraint on gas was never the resource. It was measurement, routing and commercial decision-making, which is exactly where AI changes the economics. Today you learn why compression usually binds the whole system, why flaring is a measurement, detection and decision problem, and why methane reporting has become a data-lineage problem. Even if your company never handles a molecule of gas, the discipline of proving a reported number from source to submission applies to any figure your business reports.
25-Minute Module
0:00 – 5:00
Why gas punishes slack
- Nigeria holds more gas than oil, and national policy has framed this period as a Decade of Gas: gas for power, industry, domestic cooking and export. The book notes that NNPC has tied its production and investment ambitions explicitly to gas growth alongside oil, citing Reuters reporting on NNPC.
- Value is created or destroyed along a chain: wellhead, processing, compression, evacuation, offtake. The book's rule: the molecule that is flared, lost or stranded is as real a loss as the barrel never produced.
- Oil tolerates operational slack; gas does not. A compression limit constrains processing; a processing limit forces flaring; an evacuation constraint strands production; a metering dispute delays revenue. The weaknesses live in the connections between the parts.
- THE DOCTRINE
The constraint on gas was never the resource. It was measurement, routing and commercial decision-making, and that is exactly where AI changes the economics.
- By the time a monthly report shows flaring rose, the molecules are gone. AI will not conjure infrastructure or substitute for capital; it makes what exists perform harder.
When someone says the gas problem is a lack of pipelines, ask how well you measure what the existing ones carry.
5:00 – 11:00
Compression first: where reliability pays
- You met the binding constraint in Session 14. In gas, the book says, it is usually the compressor. A trip can cap production upstream and force flaring of associated gas that cannot be handled, so the commercial and environmental costs land at the same moment.
Method the book names What it does, in plain terms Condition monitoring Learns each machine's normal envelope and flags departures before a hard alarm trips Remaining-useful-life estimation Projects how much operating time a unit has left Process optimisation Holds the point that maximises saleable gas within specification and safety limits Flare root-cause analytics Attributes each flare event to its driver Emissions measurement and validation Turns many measurements into one validated, audit-ready figure with full lineage Demand forecasting and reconciliation Plans supply against offtake and explains imbalances between custody points - Remaining useful life matters more here: the book notes a replacement part in Nigeria can take weeks through import, FX and customs friction.
- The book's direction: insist on failure-mode specificity rather than generic anomaly alerts, and close the loop to procurement so a prediction stages a critical spare before the FX-and-logistics clock makes it urgent.
An alert that says the compressor is unwell is half an answer. Ask which failure mode, which crew and which part.
11:00 – 17:00
Flaring and methane MRV: numbers you can prove
- The book states that Nigeria has committed, alongside the global industry, to the World Bank's Zero Routine Flaring by 2030 initiative. Its flare-reduction pathway figure is conceptual and illustrative: the commitment is the date; the slope is an operating choice.
- AI works on three fronts: measurement, detection of events and their drivers, and decision support that ranks reduction opportunities by volume and value. Flaring is not one number to reduce but a portfolio of root causes to attack in value order.
- On methane, the book reports that NUPRC has directed upstream operators toward standardised templates and measurement-based methane and GHG reporting, and that its guidelines apply to operators and service providers in connection with Monitoring, Reporting and Verification.
- THE DOCTRINE
An emissions figure that cannot be followed from its source, through its calculations, to its submission is a finding waiting to happen. AI raises the governance bar; it does not remove it.
- Four questions must always have answers: where the data came from, who approved it, how it was calculated, whether it can be defended. MRV-grade data pays twice: in compliance and in operating performance.
- IN THE FIELD · THE WORKED CASE
- Field. A fictional gas processing company's root-cause analytics on its largest flare attributes most events to trips on one compressor train. The fix sits in reliability and spares, not at the flare stack.
IN THE BOARDROOM · THE PARALLEL- Boardroom. Its board sees one line: flaring up. The better question is which root causes, in value order, with which owner, and whether the figure can be reconstructed for the regulator on demand. The same loop, seen from the other end.
Treat the methane mandate as the forcing function that finally makes you measure what you have been wasting.
17:00 – 22:00
Custody, sequence and the gas scoreboard
- Beyond the plant fence, weak custody data breeds disputes that validated reconciliation turns into evidenced calculations. The Sequencing Discipline in the book's order: compression reliability and flare/MRV first; demand and custody next; full gas-plant twins once the data foundation is proven. A twin built on untrusted data is an expensive way to be confidently wrong.
- The book's 90-day plan ends by launching three to five pilots, typically compression on the highest-consequence machine, the largest flare, and MRV lineage on the reporting that matters most. Each needs a business owner, data owner, success metric, baseline, governance control and executive sponsor.
Board measure What it tells you Gas-plant availability and compression uptime Whether the asset makes saleable gas Flare-intensity reduction and routine-flaring-elimination progress Molecules recovered Methane intensity and GHG-reporting defensibility Credibility under measurement-based MRV Molecule-reconciliation accuracy Trust in the commercial numbers Gas-to-power supply reliability Delivery against demand - Each needs a baseline; the book's scoreboard figure is illustrative. Its failure modes include treating MRV as a reporting exercise rather than a lineage discipline, and delegating the programme to IT or a vendor.
If a vendor's first proposal is the full plant twin, ask what the compressor data looks like today.
22:00 – 25:00
Before you close the laptop
- Write one line: where your company's molecules, flares or emissions numbers come from, and where they go. If you cannot write it, that is your first finding.
- This session produces Section 16 of your 90-Day AI Survival Game Plan: your gas, flaring or emissions-measurement position and the AI response.
- No gas exposure? The book says NUPRC's guidelines reach service providers too. Otherwise, use the nearest equivalent: a regulated or contractual number your business could not reconstruct from source today.
The molecule is the decade. Write as if your board will have to prove every number in this section.
Key Terms
Zero Routine Flaring by 2030
The World Bank initiative to which, the book states, Nigeria has committed alongside the global industry.
Measurement-based MRV
Monitoring, Reporting and Verification built on validated measurement with full lineage rather than loose estimates; the direction NUPRC has set for methane and GHG reporting.
Flare root-cause analytics
Correlating flare events with surrounding operating data to attribute each to its driver: a compression limit, processing constraint, evacuation bottleneck or upset.
Molecule reconciliation
Comparing metered volumes across custody points to detect and explain imbalances, so allocation becomes an evidenced calculation.
Self-Check — Before You Submit
1. Why does the book recommend starting a gas AI programme with compression and the gas plant?
- A. Compressors are the cheapest equipment to instrument
- B. Compression usually binds the system, the data is rich, and a trip can cap production and force flaring at once
- C. Regulators require predictive maintenance on compressors
- D. A gas-plant twin needs compressor data first
B. Compression usually binds the system, the data is rich, and a trip can cap production and force flaring at once — The book's reason is structural: compression usually binds the system and a trip caps production and forces flaring together. It cites no regulatory requirement, and the twin comes last in its sequence.
2. A fictional gas company's HSE director wants to buy an enterprise emissions platform this quarter. Nobody can say who approved last year's methane figure or how it was calculated. What do you authorise?
- A. The platform, so the company is seen to act
- B. A consultant to restate the figure using industry averages
- C. An MRV lineage pilot on the reporting that matters most, building source, calculation, approval and evidence into the workflow first
- D. Nothing until NUPRC issues final templates
C. An MRV lineage pilot on the reporting that matters most, building source, calculation, approval and evidence into the workflow first — The book treats MRV as a lineage discipline and names buying the platform before fixing the data as a failure mode. Restating with averages repeats the estimation problem; waiting ignores the direction NUPRC has already set.
3. In the book's sequencing of the gas AI portfolio, what comes first?
- A. Compression reliability and flare/MRV
- B. Demand forecasting and custody accounting
- C. A full gas-plant digital twin
- D. An enterprise data lake covering every gas data set
A. Compression reliability and flare/MRV — Compression reliability and flare/MRV first, demand and custody next, twins last. A perfect data lake before anything happens is what the book warns against; the foundation is built around the highest-value decisions.
Today’s Assignment
Write Section 16 of your plan: your company's gas, flaring or emissions-measurement position, its binding constraint, and the AI response in the book's sequence.
- State your company's position: the gas it produces, processes, moves, burns or buys, or the emissions figures it reports. With no gas exposure, use a regulated or contractual number you could not reconstruct from source today.
- Name the binding constraint as measurement, routing or commercial decision-making, with evidence.
- Trace one reported figure from source through calculation and approval to submission, answer the book's four questions, and mark where the chain breaks.
- Choose the method that applies first, say what waits and why, and outline one pilot with all six elements named by role.
- Say honestly what your company gets wrong today: estimating instead of measuring, flaring treated as one number, or reconciliations nobody can defend.
YOUR 90-DAY PLAN
Section 16 — Our gas, flaring or emissions-measurement position and the AI response.
How this is marked — the rubric
| Position and binding constraint stated with evidence, not assertion | 25 |
| One figure traced from source to submission, with the break located | 30 |
| Response sequenced in the book's order, with what waits and why | 20 |
| Pilot with all six elements named by role and a baseline | 25 |
| Total · pass mark 70 | 100 |
Submitting session 16
Write your answer in Word or Google Docs. The first line must read
Write your answer in Word or Google Docs. The first line must read
Session: 16, or the submission is refused. Upload the Word file (.docx), or switch to the Google Doc tab and paste your document’s share link.Marked against the rubric above and returned as a written letter, saved to your progress page. Do not submit until you have passed the self-check above.Capabilities Covered
Gas value-chain thinkingCompression as constraintFlare root-cause disciplineMethane MRV lineageGas portfolio sequencing
Part Four · Gas and the DownstreamSESSION 17
The Downstream Reset
Why This Matters
Most of this programme has been about finding, producing and protecting hydrocarbons. Today turns downstream, because the book argues Nigeria's downstream has undergone a structural reset: from an import-dependent fuels market to one anchored by large-scale domestic refining. The book is honest that the refineries are the change, not AI. But a refinery run well is worth far more than the same refinery run poorly, and that conversion is where AI is decisive. This session matters whether you run a downstream business, supply one or simply depend on one for fuel, product or customers. The old assumptions about where product comes from, how it moves and what it costs are shifting, and your plan should say how that changes your company.
25-Minute Module
0:00 – 5:00
What has been reset
- For decades the downstream was defined by a paradox: a major crude producer that imported most of its refined products, with heavy foreign-exchange exposure, limited domestic refining, distribution built around imported product, and little of the rich operating data a refining-led system produces.
- The book's landmark example is the Dangote Refinery near Lekki, which it describes as widely reported to be one of the world's largest single-train refineries, with a design capacity of around 650,000 barrels per day. It is the only facility the chapter names, and the only one this session names.
- A refining-led downstream must optimise crude selection, run refineries reliably, maximise high-value yield, assure specification, distribute across a difficult network, forecast demand and run competitive retail. At this scale, these problems are largely new.
- THE DOCTRINE
The downstream reset is an opportunity created by infrastructure, not by AI. The refineries are the structural change; AI is how that opportunity is converted into realised value.
Ask which of your planning assumptions was written for the import era, and whether anyone has checked it since.
5:00 – 11:00
The chain, and the value in its seams
Stage Where AI creates value Crude supply The cheapest crude blend that makes the desired product slate within the refinery's constraints Refining Reliability, yield and energy efficiency Blending and products Minimising give-away: specification an unoptimised blend wastes Logistics and distribution Inventory, routing and loss Retail and customer Demand matching, margin and experience - The stages are coupled. The crude selected affects yield, which affects the products available, which affects what the network carries and what retail can sell. Each stage can run well and the business still lose: a refinery making products the network struggles to move, or inventory sized to the wrong demand.
- THE DOCTRINE
Local optima do not sum to a global optimum. An operator can have every part of the chain running well and still leave large value in the seams between them.
- The downstream is high-volume and thin-margin, so fractional gains in yield, loss or forecast accuracy are worth a great deal at scale. The book gives no figure for that value, and neither will I. Your baseline will supply it.
When each function reports a good month and the business does not, look at the handoffs first.
11:00 – 17:00
Refinery, network and demand
- The refinery. Three levers: yield, the largest lever on refining margin; energy, a major cost; and reliability, because an unplanned outage is enormously expensive. Build on the advanced process control refineries already have, not replace it.
- The network. Optimise depots, trucking, marine and retail as one system. The three levers in Nigerian fuel distribution: working capital tied in inventory, distribution loss and supply reliability.
- Demand. Accurate forecasting lets the network carry less safety stock while still avoiding stock-outs. The book's chart of this is conceptual, not field data. An optimised network on a poor forecast still carries the wrong inventory in the wrong place.
- Reliability as energy security. The reset concentrates national fuel supply in fewer large, critical assets, so an outage now affects national supply directly. Domestic refining must also produce on-specification, cleaner fuels reliably.
- IN THE FIELD · THE WORKED CASE
- Field. A fictional fuel distribution company's depot managers each hold generous buffers, because stock-outs are remembered and excess stock is not. Every depot looks well run; the network carries the wrong inventory in the wrong places.
IN THE BOARDROOM · THE PARALLEL- Boardroom. Its board sees working capital rising while supply complaints continue. The decision is not a better depot target. It is one demand forecast across the network, one owner for the whole, and inventory turns and forecast accuracy measured against a baseline.
A buffer is a forecast nobody wrote down. Ask to see the forecast.
17:00 – 22:00
Sequence, pilot and the downstream scoreboard
- The book's sequence: trusted, integrated data; then refinery reliability and yield; then distribution and demand; then retail analytics; whole-chain integration built progressively. Chasing integrated optimisation before the foundations exist stalls under its own complexity.
- The 90-day pilot runs diagnose, build, deliver, with a business owner, data owner, baseline, measured outcome and executive sponsor. The book's test: a forecast that does not improve a measured operating outcome is a study, not a result.
Board measure What it tells you Refinery availability and crude-to-product yield The most valuable slate, produced reliably Energy efficiency A major cost, and emissions performance Product supply reliability Whether the market is served Inventory turns and working capital Capital the network ties up Distribution-loss reduction Leakage that erodes margin Demand-forecast accuracy The signal the system runs on Retail margin and experience The customer-facing business - Two failure modes I would underline. Chasing yield while neglecting the predictive maintenance that prevents the outage that dwarfs any yield gain. And neglecting local capability: a downstream run on foreign-controlled intelligence is, in the book's words, a dependency at the heart of national energy security.
Ask your downstream team for the outage plan before the yield plan.
22:00 – 25:00
Before you close the laptop
- Decide your position: your company is downstream, supplies it, or depends on it for fuel, product, power or customers. Many hold more than one.
- Write down one import-era assumption your business still runs on: supply source, lead time, price exposure, logistics or customer demand.
- This session produces Section 17 of your 90-Day AI Survival Game Plan: how the downstream reset changes your business.
Do not defend the model the imported era handed you. Write down what you would rebuild.
Key Terms
Downstream reset
The book's term for Nigeria's shift from an import-dependent fuels market to one anchored by large-scale domestic refining.
Quality give-away
Valuable specification an unoptimised blend wastes by exceeding what the product requires.
Whole-chain optimisation
Steering crude, refining, blending, distribution and retail as one coupled system, so crude reflects demand and inventory reflects forecast.
Safety stock
Inventory held against uncertain demand. A better forecast lets the network hold less without more stock-outs, releasing working capital.
Self-Check — Before You Submit
1. According to the book, which is the largest lever on refining margin?
- A. Energy optimisation
- B. Retail pricing
- C. Yield
- D. Tanker scheduling
C. Yield — The book calls yield the largest lever on refining margin. Energy is a major cost, but the book does not rank it above yield; the other two sit elsewhere in the chain.
2. A fictional downstream marketer is offered an advanced network-optimisation platform. Its depots set inventory by rules of thumb and it has no trusted demand forecast. What does the book's doctrine say to do first?
- A. Build the forecast and the trusted data beneath it, then optimise the network as one system against it, with a baseline
- B. Buy the platform, since network optimisation is highly tractable
- C. Optimise each depot separately before integrating
- D. Defer all network work until the refinery chain is integrated
A. Build the forecast and the trusted data beneath it, then optimise the network as one system against it, with a baseline — An optimised network on a poor forecast still carries the wrong inventory. Depot-by-depot optimisation is the isolated approach the book rejects, and waiting for full integration inverts the sequence.
3. Why does the book treat ignoring reliability as a failure mode even when yield optimisation is working?
- A. Reliability programmes are cheaper
- B. Regulators assess refineries on availability only
- C. Yield models cannot run without maintenance data
- D. An outage can dwarf any yield gain, and supply is now concentrated in fewer large assets
D. An outage can dwarf any yield gain, and supply is now concentrated in fewer large assets — The book's logic is consequence: the outage dwarfs the yield gain, and concentration makes reliability an energy-security matter. It makes no claim about relative cost or an availability-only regulatory test.
Today’s Assignment
Write Section 17 of your plan: how the downstream reset changes your company, whether you are downstream, supply it or depend on it.
- State your company's position relative to the downstream, and which stages of the chain touch your business.
- Name two import-era assumptions your business still runs on, and how the reset changes each.
- Identify where your company loses value in a seam between stages or functions, and who, if anyone, owns that seam.
- Choose the first AI-supported decision that would capture value from the reset, in the book's sequence, and the board measure (or nearest equivalent) you would baseline.
- Say honestly what your company gets wrong: buffers instead of forecasts, functions optimised in isolation, reliability traded for throughput, or capability rented rather than built.
YOUR 90-DAY PLAN
Section 17 — How the downstream reset changes our business.
How this is marked — the rubric
| Position on the chain stated precisely, with the stages that touch the business | 20 |
| Two import-era assumptions named and the reset's effect on each explained | 25 |
| A value-losing seam identified, with its owner or the absence of one | 25 |
| First decision sequenced in the book's order, with a baselined measure | 30 |
| Total · pass mark 70 | 100 |
Submitting session 17
Write your answer in Word or Google Docs. The first line must read
Write your answer in Word or Google Docs. The first line must read
Session: 17, or the submission is refused. Upload the Word file (.docx), or switch to the Google Doc tab and paste your document’s share link.Marked against the rubric above and returned as a written letter, saved to your progress page. Do not submit until you have passed the self-check above.Capabilities Covered
Downstream value-chain mappingIntegration over local optimaInventory and forecast disciplineReliability as energy securityReset-era sequencing
Part Four · Operational TrustSESSION 18
AI Governance: Trust Is Engineered
Why This Matters
Every capability in this programme so far, from predictive operations and twins to optimisation and gas analytics, creates durable value only if it can be trusted. Today asks who stands behind what your models do. The book's position is uncomfortable for many boards: if governance does not control what models do, prove what they did and contain the consequences when they are wrong, the organisation does not have AI governance. It has AI risk it has chosen not to see. You will learn why the asymmetry of consequence demands an asymmetry of control, what governance must cover, and how accountability is layered across three lines of defence. Then you map it for your own company, object by object, owner by owner.
25-Minute Module
0:00 – 5:00
When the model starts to recommend
- When a model only produced a report a human fully reviewed, the governance burden was light. When it recommends a field action, adjusts a setpoint, screens a compliance filing or feeds an executive decision, the burden becomes serious: consequential judgement is being transferred, in part, to systems that must be controlled.
- This is the Value-versus-Risk Map applied to control. A wrong recommendation in a consumer app produces a poor playlist; at a wellhead it can produce a safety event, a deferment or an environmental breach. The asymmetry of consequence demands an asymmetry of control.
- The core problem is not a lack of data. Models are scattered, unowned, unvalidated and disconnected from accountability: black boxes, weak ownership, uncontrolled access, poor audit trails, OT cyber exposure and leadership distrust.
- THE DOCTRINE
If governance does not control what models do, prove what they did and contain the consequences when they are wrong, the organisation does not have AI governance. It has AI risk it has chosen not to see.
- Avoid both errors the book names: governance as bureaucracy that slows innovation, and governance as a document written once and filed.
The board's first governance question needs no expertise: show me the model inventory.
5:00 – 11:00
Operational trust and the seven controls
- Operational trust sits where three disciplines meet: risk management, whether models are valid, reliable and monitored; compliance, whether obligations are met and provable; and cybersecurity, whether systems are secure where they touch OT. A validated model on an insecure system is not trustworthy, and neither is a secure system producing indefensible numbers.
Control What it does Model risk management Validates before trust, monitors in production, detects drift, retires or retrains AI inventory control A live register: what each model does, its data, what it can touch, its owner, last validation Role-based access Only the right people view, modify or approve, down to the OT layer Audit logging An immutable record of who did what, when, with which data, on whose approval Human-in-the-loop approval Which decisions need human validation, by whom, on what evidence Cybersecurity-by-design No uncontrolled bridges between enterprise IT and field OT AI management system Coordinates roles, policy, risk assessment, monitoring and improvement - The stack is built from a secure foundation up. The book calls cybersecurity-by-design, guided by NIST SP 800-82, the foundational control beneath all others; the AI management system, which ISO/IEC 42001 formalises and the NIST AI RMF guides, ties them together. Oversight without the controls beneath it is governance on paper only.
- THE DOCTRINE
A policy that is not enforced by a control is a wish; a control without an owner is a gap.
For each control, ask who would notice if it stopped working tomorrow.
11:00 – 17:00
What governance must cover
- AI is a layer across many objects, and the book lists eight that must sit inside the governance perimeter, each with a named owner:
Object Why it matters ungoverned AI models The single highest-risk object: confidently wrong at scale Data pipelines Silently corrupt every model downstream SCADA interfaces Faults or compromise can have physical consequences Dashboards An unvalidated dashboard is an ungoverned decision tool Field decision workflows Where a recommendation becomes a crew's action Compliance systems Scrutinised by regulators, auditors and partners Executive reports A board governing on ungoverned numbers is governing on sand Third-party platforms Import models, data flows and access the operator does not control - Three principles: completeness, because the ungoverned object is where failure starts; accountability, a named owner layered across the lines of defence; proportionality, strictest controls first on SCADA interfaces, compliance systems and field decision workflows.
- The book's warning: the most dangerous failure is the object everyone assumes someone else is governing. Third-party platforms are the classic case, trusted on reputation instead of assessed.
The board need not govern every detail. It must know that nothing consequential is ungoverned.
17:00 – 22:00
The three lines of defence
- First line: the engineers and operators who build and run AI own its risk day to day: they maintain the inventory, apply controls and validate outputs.
- Second line: risk, compliance and cybersecurity set policy, monitor and have the standing to challenge the first line. The book observes that in many Nigerian operators this second-line capability for AI is nascent. You cannot challenge what you do not understand.
- Third line: internal audit gives independent assurance that controls actually operate. Above all three, the board and executive own risk appetite and ultimate accountability; around them sit regulators such as NUPRC and standards such as the NIST AI RMF and ISO/IEC 42001.
- IN THE FIELD · THE WORKED CASE
- Field. In a fictional upstream operator, a production engineer builds a model that ranks wells for intervention and feeds a weekly dashboard. It works. It is in no inventory, nobody in risk has reviewed it, and its access rights were never set.
IN THE BOARDROOM · THE PARALLEL- Boardroom. The board asks for the model inventory and receives a list that omits it. The fix is not a ban. It is a first-line owner, a second-line reviewer and an audit trail, so the board can say yes with evidence.
- THE DOCTRINE
A board that cannot describe its AI governance is a board carrying a risk it has not chosen to understand.
Ask who in your second line could challenge a model owner today, and on what knowledge.
22:00 – 25:00
Before you close the laptop
- List every object AI touches, or will touch first, in your company. Mark the one nobody owns.
- This session produces Section 18 of your 90-Day AI Survival Game Plan: your accountability map across the three lines of defence.
- Pop Quiz 4 — Gas, the Downstream and Governance opens now: five questions, closed book, covering Sessions 16 to 18.
We do not trust AI because it is clever. We trust it when the accountability around it is strong.
Key Terms
Operational trust
The ability of leaders, regulators, partners and field teams to rely on a system's numbers and decisions, where risk management, compliance and cybersecurity meet.
AI inventory
A live register of every model in use, what it touches, who owns it and when it was last validated. The foundation of every other control.
Governance perimeter
The objects AI touches that must be governed, from models and pipelines to SCADA interfaces and third-party platforms.
Three lines of defence
Model owners build and run; risk, compliance and cybersecurity challenge; internal audit assures; the board owns risk appetite.
Self-Check — Before You Submit
1. In the book, operational trust sits at the intersection of which three disciplines?
- A. Data science, engineering and finance
- B. Risk management, compliance and cybersecurity
- C. Operations, HSE and procurement
- D. Strategy, technology and execution
B. Risk management, compliance and cybersecurity — The book names risk management, compliance and cybersecurity, held together by governance. The other sets are real functions, but none substitutes for the three the book names.
2. Which object does the book call the single highest-risk object when ungoverned?
- A. An AI model
- B. An executive report
- C. A dashboard
- D. A third-party platform
A. An AI model — An ungoverned model, because it can be confidently wrong at scale. The book calls third-party platforms among the most overlooked risks, which is a different claim.
3. A fictional EPC company's planning team has connected a reputable vendor's AI scheduling platform to its project data. Nobody outside the team has reviewed it. What should the sponsor do?
- A. Leave it, since the vendor's reputation is the assurance
- B. Switch it off until a company-wide framework is written
- C. Ask internal audit to own the platform
- D. Bring it inside the perimeter: assess security, model risk, data handling and accountability, and name a first-line owner
D. Bring it inside the perimeter: assess security, model risk, data handling and accountability, and name a first-line owner — Vendor platforms must be assessed, not trusted on reputation, and every object needs an owner. Audit assures rather than owns, and waiting for a complete framework is the policy-binder approach the book warns against.
Today’s Assignment
Write Section 18 of your plan: the accountability map for what AI touches, or will touch first, in your company, across the three lines of defence.
- List your company's objects under the book's eight categories, including spreadsheets and vendor tools that already drive decisions.
- For each, name the first-line owner, the second-line challenger and how the third line would assure it, by role, not department.
- Mark every object with no owner, and every one everyone assumes someone else governs.
- Rank the three objects that need the strictest controls first and say which of the seven controls each lacks.
- Say honestly whether your second line could challenge a model owner today. If your company has no AI in use yet, map the proposal or tool in front of you.
YOUR 90-DAY PLAN
Section 18 — Our accountability map across the three lines of defence.
How this is marked — the rubric
| Objects listed across the eight categories, including informal tools | 20 |
| Owners named by role for each line, not by department | 30 |
| Ungoverned and assumed-governed objects identified honestly | 25 |
| Three priority objects ranked by consequence, with missing controls named | 25 |
| Total · pass mark 70 | 100 |
Submitting session 18
Write your answer in Word or Google Docs. The first line must read
Write your answer in Word or Google Docs. The first line must read
Session: 18, or the submission is refused. Upload the Word file (.docx), or switch to the Google Doc tab and paste your document’s share link.Marked against the rubric above and returned as a written letter, saved to your progress page. Do not submit until you have passed the self-check above.ASSESSMENT NOW OPEN
Pop Quiz 4 — Gas, the Downstream and Governance opens now. Sit it before you start the next session — it is how you find out whether the doctrine landed, and the practice papers may be resat as often as you like.
Sit Pop Quiz 4 →Closed book, no notes, and Coach Ritchie switches himself off while you sit it.Capabilities Covered
Asymmetry of controlGovernance control stackGovernance perimeterThree lines of defenceSecond-line challenge
Part Four · Operational TrustSESSION 19
Governing at Scale: Rhythm, Security and the Governance Scoreboard
Why This Matters
Session 18 drew the accountability map. Today makes it run. The book is blunt that governance written as policy changes nothing: a control that is not enforced by a system or an accountable owner is a wish. Here you design a 90-day governance pilot on your highest-risk models, put governance into the daily, weekly and monthly rhythm, and build the scoreboard a board can actually read. You will also meet the book's most counter-intuitive claim: the fastest-scaling AI organisations are the best-governed ones, not the least-governed. If your board currently measures governance by policies written and committees formed, this session is about replacing those with measures of control.
25-Minute Module
0:00 – 5:00
The value of governance, mapped
- Too many organisations treat governance as overhead until a failure makes its absence expensive. The book's value map has four parts:
Part The question for your company Avoided loss What would one ungoverned model failure, one indefensible compliance figure or one cyber incident through an AI interface cost? Enablement Which deployments could the board approve if it could see and trust its controls? Trust capital How much more credible would you be to regulators, lenders and partners? Resilience Would controls survive vendor change, staff turnover and cyber threat? - THE DOCTRINE
Governance, paradoxically, is an accelerator: it removes the uncertainty that keeps AI stuck in pilots. The fastest-scaling AI organisations are the best-governed ones, not the least-governed.
- The risk of inaction is hidden until it is catastrophic. An organisation that scaled without governance has an undisclosed liability that compounds with every model it adds, and the book notes lenders and partners are beginning to ask how AI is governed.
When governance is called a cost, ask what the first failure would cost and who would explain it.
5:00 – 11:00
The 90-day governance pilot
- Scope it to the highest-risk models or most consequential reporting: the models feeding compliance reporting, the AI touching a critical SCADA interface, the highest-consequence field decision workflow.
- Days 1–30, discovery and baseline: inventory the models in scope, find their owners or their absence, map lineage, access and cyber exposure, quantify control gaps. Output: a governance charter of scope, baseline, target controls, accountability map and first risks.
- Days 31–60, build and apply: inventory, ownership, access and logging controls, human-in-the-loop approval points, cyber review, applied to real systems, not a policy document.
- Days 61–90, assurance and adoption: test, audit and embed the controls, and track which ones changed behaviour. The book notes many efforts fail here, producing a framework they never verify.
- IN THE FIELD · THE WORKED CASE
- Field. A fictional marginal field operator scopes its pilot to the spreadsheet model behind its emissions submission. By day 60 it has an owner, an access list, a change log and a named approver who reviews the figure before it leaves the building.
IN THE BOARDROOM · THE PARALLEL- Boardroom. At day 90 the executive committee decides: continue, expand, adjust or stop, on audited evidence that the controls operated, not on the existence of a policy.
A pilot that ends with a framework and no audited control is a policy, not governance.
11:00 – 17:00
Scale and rhythm: from documented to enforced
- Three scaling principles: standardisation of control standards, model classifications, approval thresholds and roles; enforcement built into tools, access systems and workflows; and ownership the business cannot outsource. For Nigeria, the book adds second-line and audit capability for AI, built locally.
- THE DOCTRINE
The shift from documented governance to enforced governance is the single most important step in scaling safely. Scaling unenforced governance multiplies false assurance.
- The rhythm. Daily: drift flags, security alerts, human overrides, failed controls. Weekly: overdue validations, ownership gaps, incidents, audit findings. Monthly: the scoreboard, concentrated residual risk and investment, with the rigour given to financial or safety risk.
- Human in the loop, genuinely. The model proposes; the person decides and is accountable. A rubber stamp is not a control. The book's anchors are the NIST AI RMF, ISO/IEC 42001 and NIST SP 800-82 for OT.
- Local Content 2.0. The book notes NCDMB was established under the Nigerian Oil and Gas Industry Content Development Act. Its argument: vendors certifying their own systems is not indigenous capability. Owning the trust infrastructure is part of ownership.
If a control depends on someone remembering to apply it, assume it has already lapsed.
17:00 – 22:00
The governance scoreboard
- Policies written and committees formed are activity. The book's eight measures of control:
Measure What it proves Model inventory completeness The board can see what it governs Auditability What a model did can be reconstructed Data lineage coverage Critical data flows are traceable Access control compliance Access matches policy Incident response time Controls are operational and damage is bounded Human approval adherence Reviews are genuine Model performance drift control Models are acted on before they decay Regulatory reporting confidence The company can defend and reproduce its reporting - On human approval adherence the book is specific: a high recommendation-to-approval rate with no rejections is a warning sign, not a success.
- Each measure needs a baseline; the book's figure shows illustrative status only. Add enforcement and assurance checks, such as whether audit has verified the controls, and learning velocity from incidents and near-misses.
The capstone question for any board: can we stand behind our numbers, and how do we know?
22:00 – 25:00
Before you close the laptop
- Pick the one object from your Session 18 map whose failure would hurt most. That is your pilot scope.
- This session produces Section 19 of your 90-Day AI Survival Game Plan: your governance pilot, rhythm and scoreboard.
- Note which of the eight measures you could baseline today. For most companies the honest answer is few or none.
Build the controls before the incident, not after. The accountability starts with you.
Key Terms
Governance charter
The pilot's first-thirty-day output: scope, baseline, target controls, accountability map and the risks addressed first.
Enforced governance
Controls built into tools, access systems and approval workflows, so they operate whether or not anyone remembers the policy.
Human approval adherence
The rate at which decisions requiring human validation receive genuine review rather than a rubber stamp.
Model performance drift control
Monitoring models in production for degradation and acting before they become confidently wrong.
Self-Check — Before You Submit
1. A model's recommendations have been approved every time for many months, with no rejections. How does the book read this?
- A. Proof the model is highly accurate
- B. A reason to move the model up the autonomy ladder
- C. A warning sign that the review may not be real
- D. A neutral fact with no governance meaning
C. A warning sign that the review may not be real — The book calls a high approval rate with no rejections a warning sign, because the review may not be real. Treating it as proof of accuracy or grounds for autonomy mistakes a rubber stamp for evidence.
2. Sixty days into a fictional gas company's governance pilot, the team presents a polished framework. No control has touched a live system. What should the sponsor require?
- A. Approval of the framework and a company-wide rollout
- B. Controls applied to the real in-scope systems and audited before day 90
- C. A second framework from another consultant
- D. Extending discovery to every model in the company
B. Controls applied to the real in-scope systems and audited before day 90 — The second thirty days apply controls to real systems and the final thirty audit them. Rolling out an unenforced framework multiplies false assurance; widening discovery abandons the high-risk scope.
3. Which step does the book call the single most important in scaling governance safely?
- A. The shift from documented to enforced governance
- B. Obtaining ISO/IEC 42001 certification
- C. Forming an AI ethics committee
- D. Centralising all models in one platform
A. The shift from documented to enforced governance — The book names the shift from documented to enforced governance. ISO/IEC 42001 is a credible backbone, but adoption without enforcement is still activity, as is forming a committee.
Today’s Assignment
Write Section 19 of your plan: your company's 90-day governance pilot, its operating rhythm and its governance scoreboard with baselines.
- Scope the pilot to the highest-risk object from your Section 18 map and say why its failure would hurt most.
- Write the governance charter, then what is built in days 31–60 and how it is audited in days 61–90.
- Set the daily, weekly and monthly rhythm in named existing meetings, with chairs by role.
- Choose at least four of the eight measures, with today's baseline (or a plain statement that none exists and how you will set one) and a day-90 target.
- Say honestly where your company's governance is documented but not enforced. With no AI in use yet, scope the pilot to the first proposal or vendor tool in front of you.
YOUR 90-DAY PLAN
Section 19 — Our governance pilot, rhythm and scoreboard.
How this is marked — the rubric
| Pilot scoped to a genuinely high-risk object, with a complete charter | 30 |
| Days 31–90 apply and audit controls on real systems, ending in a continue, expand, adjust or stop decision | 20 |
| Rhythm placed in named meetings with chairs by role | 20 |
| Scoreboard with honest baselines and targets, plus a documented-versus-enforced finding | 30 |
| Total · pass mark 70 | 100 |
Submitting session 19
Write your answer in Word or Google Docs. The first line must read
Write your answer in Word or Google Docs. The first line must read
Session: 19, or the submission is refused. Upload the Word file (.docx), or switch to the Google Doc tab and paste your document’s share link.Marked against the rubric above and returned as a written letter, saved to your progress page. Do not submit until you have passed the self-check above.Capabilities Covered
Governance value caseGovernance pilot designEnforcement over documentationGovernance operating rhythmGovernance scoreboard
Part Four · Operational TrustSESSION 20
Crude Theft and Pipeline Surveillance
Why This Matters
This chapter is the clearest illustration of the book's central claim: the next barrel often comes not from new geology but from a loss prevented. A barrel lost through theft, a leak or a vandalised line is as real as a barrel never drilled, and it needs no drilling to recover. NUPRC has reported crude losses at a 16-year low and NNPC has described pipeline theft as nearly eliminated; the book's task is to make those gains permanent and predictive. Today you learn why detection time is loss, how six methods fuse into one credible alert, and how a board should measure protection as performance. If your company has no pipeline, the same logic applies to your largest preventable loss.
25-Minute Module
0:00 – 5:00
Detection time is loss
- The book cites NUPRC: crude losses at a 16-year low, with January–July 2025 losses of 2.04 million barrels and a 9,600 bpd average. Recomputing from the book's own two figures, not adding a new one: January to July 2025 is 212 days, and 9,600 × 212 = 2,035,200 barrels, which rounds to the 2.04 million reported. Reuters reported NNPC describing pipeline theft as nearly eliminated, and Nigeria stepping up its crackdown on oil theft as it targets 3 million bpd.
- The surface area: NUPRC describes onshore processing infrastructure linked to export terminals through 5,284 kilometres of pipelines, precisely what a surveillance programme must protect.
- THE DOCTRINE
In pipeline incidents, detection time is loss. Every hour between a tap and a response is barrels gone, environmental damage done and integrity compromised.
- Weakness accumulates from small things: a pressure anomaly not investigated, a community report not escalated, a recurring tapping point accepted as normal. The book adds that indirect costs, from remediation to reputation, often dwarf the value of the stolen barrels.
A recovered barrel is production. Treat it as a win, not as a security cost avoided.
5:00 – 11:00
Defence in depth: many signals, one alert
- No single layer is sufficient. Satellites see wide but infrequently; drones see closely but narrowly; SCADA pressure and flow sense a breach's hydraulic signature but not its cause; patrols and communities supply ground truth. AI is the layer that fuses them.
Method Its role in the defence Geospatial analytics Puts risk in physical context on the network map Pressure and flow anomaly detection The fastest, most continuous layer, watching every kilometre Satellite image classification Wide-area change detection that directs scarce drones and patrols Drone video analytics Flags the frames that matter, so teams review exceptions only Route-risk scoring A live risk score per segment, replacing a flat patrol schedule Incident prediction models Where the next breach is most likely, focusing human judgement - The book's example of fusion: a pressure anomaly alone may be a transient; a satellite flag alone may be a false positive; a community report alone may be unverified. Together they become one high-confidence, localised alert worth dispatching a team for, and requiring corroboration is how false alarms fall.
- THE DOCTRINE
The model cannot be separated from the workflow. An alert without a responsible owner is operational noise; a prediction without a response path is a document.
When a vendor sells you one more sensor, ask what it will be fused with and who will act on the result.
11:00 – 17:00
Where barrels are exposed, and who acts
- The book's asset classes run from pipelines, flowlines and manifolds to export routes, terminal connections, right-of-way corridors, drones and patrol systems. Flowline losses hide because each line is small; terminal connections are where reconciliation losses become contractual disputes.
- Three patterns recur: early warning in the first hour, not the first week; prioritisation of scarce teams where route-risk scoring shows exposure; and executive visibility of open incidents and overdue responses.
- Decision rights come before technology: who receives, validates and owns the response, and when it escalates to security partners or regulators. People validate and decide within the security and community context, and the book asks for particular care around privacy and the appropriate use of imagery and location data.
- IN THE FIELD · THE WORKED CASE
- Field. On a fictional operator's trunkline segment, a night-time pressure drop, a satellite flag of fresh clearing and a community report converge into one alert within hours. The team then waits on access and security coordination.
IN THE BOARDROOM · THE PARALLEL- Boardroom. The board sees detection time falling and losses flat. The book explains why: response time exposes validation, dispatch, access and security coordination, and in Nigerian terrain that chain, not detection, is often the binding constraint. The board funds the response chain.
Detection without fast response only documents the loss.
17:00 – 22:00
The pilot and the protect-to-performance scoreboard
- The book's pilot targets one corridor, high-loss segment, manifold cluster or export route, with a sponsor spanning operations and security. Days 1–30 set the baseline and charter; days 31–60 build fusion rules and thresholds; days 61–90 put alerts into the daily meeting and tune rules on false alarms. Then continue, expand, adjust or stop.
- Each use case needs an executive sponsor, process owner, data owner, field owner and governance owner.
Protect Perform Crude losses, auditable against reconciliation Pipeline availability Incident detection time Loss volumes avoided, credited conservatively Response time Surveillance coverage False alarm rate Export reliability - Cameras deployed and alerts generated are activity; each of the eight needs a baseline. And protection is inherently local: the book warns that foreign-built models that do not understand the terrain, communities and threat patterns will underperform.
Ask for the cost of a false alarm and the cost of a missed detection in the same sentence.
22:00 – 25:00
Before you close the laptop
- Name your largest preventable loss. Without pipelines, apply the logic to fuel, materials, equipment, cargo or revenue your business loses because it detects late.
- This session produces Section 20 of your 90-Day AI Survival Game Plan: your largest preventable loss and the fused-signal response.
- Practice Exam 4 — Midpoint opens now: fifteen questions covering Sessions 1 to 20, the halfway check on the doctrine so far.
Protecting what already flows is not a security cost. It is the easiest growth on your books.
Key Terms
Defence in depth
Protection from overlapping detection layers (satellite, drone, hydraulic, patrol and community) so what one misses another catches.
Signal fusion
Combining independent signals about the same place and time into one corroborated, localised, owned alert.
Route-risk scoring
A continuously updated risk score for every segment, used to deploy scarce surveillance where exposure is highest.
Loss volumes avoided
Volume credibly shown to have been prevented from loss, credited conservatively with before-and-after logging.
Self-Check — Before You Submit
1. What did NUPRC report, as the book cites it, for crude losses in January–July 2025?
- A. 9.6 million barrels and a 2,040 bpd average
- B. 2.04 million barrels and a 9,600 bpd average
- C. 5,284 barrels at a 16-year high
- D. 2.1 million barrels against a 3 million bpd target
B. 2.04 million barrels and a 9,600 bpd average — NUPRC reported 2.04 million barrels and a 9,600 bpd average, a 16-year low. 5,284 is kilometres of onshore pipeline, and 2.1 million bpd is NUPRC's 2025 production target.
2. Which statement best captures the book's principle of signal fusion?
- A. Choose the best single sensor and retire the rest
- B. Replace patrols with satellites, which cover more ground
- C. Respond to every single-source flag, to be safe
- D. Independent signals that corroborate one another become one high-confidence, localised alert
D. Independent signals that corroborate one another become one high-confidence, localised alert — Fusion is corroboration across independent layers. Responding to every single-source flag breeds the alert fatigue the book says destroys response discipline, and patrols remain irreplaceable ground truth.
3. A fictional operator has cut incident detection time sharply, but losses on the pilot corridor have not fallen. What should the executive committee examine first?
- A. The response chain, measured as response time
- B. Higher-resolution satellite imagery
- C. More alert categories on the dashboard
- D. Retraining the model to detect even earlier
A. The response chain, measured as response time — Detection without fast response only documents the loss, and the book says the response chain is often the binding constraint. The other options improve a stage that is no longer the limit.
Today’s Assignment
Write Section 20 of your plan: your company's largest preventable loss and the fused-signal response that would detect and contain it earlier.
- Name your largest preventable loss and quantify it from your own records. Without pipeline exposure, apply the logic to fuel, materials, equipment, cargo or revenue lost through late detection.
- List the independent signals you already hold about it, and which are connected today.
- Design the fused response: which signals must corroborate, who validates, who owns the response and when it escalates.
- Write a 90-day pilot on one bounded corridor, site or loss point, with the five owners by role and baselines for detection time, response time, false alarm rate and loss.
- Say honestly where your company detects losses by their consequences rather than their signals, and whether your constraint is detection or response.
YOUR 90-DAY PLAN
Section 20 — Our largest preventable loss and the fused-signal response.
How this is marked — the rubric
| Largest preventable loss named and quantified from the company's own records | 25 |
| Existing signals inventoried, with the unconnected ones identified | 20 |
| Fusion rule, decision rights and escalation specified with owners by role | 30 |
| Bounded pilot with protect baselines and an honest detection-versus-response diagnosis | 25 |
| Total · pass mark 70 | 100 |
Submitting session 20
Write your answer in Word or Google Docs. The first line must read
Write your answer in Word or Google Docs. The first line must read
Session: 20, or the submission is refused. Upload the Word file (.docx), or switch to the Google Doc tab and paste your document’s share link.Marked against the rubric above and returned as a written letter, saved to your progress page. Do not submit until you have passed the self-check above.ASSESSMENT NOW OPEN
Practice Exam 4 — Midpoint opens now. Sit it before you start the next session — it is how you find out whether the doctrine landed, and the practice papers may be resat as often as you like.
Sit Practice Exam 4 →Closed book, no notes, and Coach Ritchie switches himself off while you sit it.Capabilities Covered
Loss prevention as productionSignal fusionRoute-risk prioritisationResponse-chain diagnosisProtect-to-performance metrics