Customers

GRI reference: EU10

Goals and targets

For generation assets, CLP monitors the availability factor in terms of the amount of time that an asset is able to produce full load equivalent electricity over a certain period, divided by the amount of time in that period. Typical values range from 70% to 90% and CLP aims to maintain an availability range of 90% and above for newer assets.

Targets for each asset are set annually and included in the business plan. Performance is reported on a weekly basis to senior management. Any significant performance variance is analysed and corrective action is taken where appropriate.

Strategies and procedures

While CLP has generation businesses across the Asia-Pacific region, Hong Kong is the only location where the business is vertically integrated. In other words, it provides generation, transmission and distribution of power, as well as retail services. CLP Power is regulated by the Hong Kong SAR Government under the Scheme of Control Agreement (SCA) which requires the Company to provide a sufficient and reliable electricity supply at a reasonable price and in an environmentally responsible manner.

In Hong Kong, CLP Power uses various measures to maintain high supply availability and reliability. These measures include:

• Upgrading generation and network facilities to meet new electricity demand;

• Maintaining sufficient generating capacity to meet forecast demand as well as planned and unforeseen outages;

• Developing an additional and economically viable gas supply option that can strengthen energy security through access to competitive gas supplies from global markets using Floating Storage and Regasification Unit (FSRU) technology;

• Adopting advanced technology such as smart grid and implementing demand-side management measures to reduce demand growth and improve utilisation of existing assets;

• Improving the quality of the power supply to minimise voltage dips;

• Enhancing power systems to minimise the impact of adverse weather; and

• Ensuring the workforce is committed and well-trained to maintain and operate the system, and provide support and emergency services around the clock.

Across the Group, CLP promotes organisational learning and builds technological capacities to ensure availability and reliability. Insights learned from regional experiences are shared among functions to plan for a consistent management framework. This practice facilitates better portfolio management and reduces risks to the Group’s operations as a whole.

Current innovative projects, promoting availability and reliability, are being pursued in the areas of robotics, asset health, video analytics, energy storage, building information modelling and automation. These projects are initiated by disruptive global start-ups or CLP's own engineers coming up with new innovations through operational experience. 

Transmission network

To cope with the territorial development of Hong Kong, CLP reviews future transmission network developments annually. It studies the latest system maximum demand forecast, area load growth, infrastructure development and generation development, and plans accordingly.

Annual maintenance and improvement programmes have been developed for major transmission assets based on the analysis of current conditions and performance of the assets, levels of investment and risk.

The power supply network is most exposed to damage from extreme climate events, potentially leading to service disruptions. In response, CLP continues to improve the reliability of its power supply network through a range of measures.

In India, Apraava Energy has adopted the philosophy of predictive and corrective maintenance of its transmission assets. This includes pre-emptive check-ups and assessments on operational clearances, ensuring assets are well structured and maintained with proper setup, hardware and security. Frequent patrolling is carried out for conducting assessments for landscape and assets. The results are used to identify defects and plan for shutdowns if needed.

A mobile application is now used by Apraava Energy for the real-time tracking of site patrols. This shortens the response time for any rectifications. Thermovision cameras are used to help the team find the defect through heat mapping.

The use of drones for site patrolling is under planning, though a ground team will be retained at strategic locations to ensure a speedy response to any damage to critical assets.

Strategies and procedures

Developed in 2016, CLP’s AMS Standard standardises essential practices in managing assets across the Group and ensures best practice. It accords with the ISO 55000 series of standards for asset management systems, as well as the ISO 31000 standards for risk management.

The AMS Standard is integrated into CLP’s Health, Safety and Environment (HSE) Management System and Project Management Governance System (PMGS) Standards to comprehensively manage the complete lifecycle of an asset.

The AMS contains five key stages and 10 asset management elements, as illustrated in the diagram below.

Overview of the CLP asset management system

Monitoring and follow-up

CLP’s customised Group Operations Information System (GOIS) is used to compile operational data on adherence to the AMS Standard. It features built-in data collection, a data compilation and an approval sequence and dashboard and reporting functions. It follows the CLP Non-Financial Data Reporting and Assurance Standard to ensure robust data governance. Relevant staff at the asset, regional and Group levels have responsibility for upholding the standard.

Continuous improvement

Initial efforts at the project planning stage are critical in determining the operational efficiency or capacity factor range of an asset through its entire lifespan. Projects involving a major asset overhaul require stringent technical and financial scrutiny before commencement.

CLP constantly identifies opportunities to improve the operational efficiency of its assets to help meet the increasingly stringent regulations on emissions and fuel efficiency in certain jurisdictions. There are also increasing improvement opportunities arising from innovation and optimisation, particularly from data analytics.

Strategy and procedures

Drawing on our long expertise in the power industry, we are implementing various initiatives to encourage residential and business customers and the community at large to use energy more efficiently. Essentially we are asking them to change their behaviour so that they can save more energy and help protect the environment.

CLP seeks to change people’s habits and encourage them to conserve energy through:

• Equipping customers with tools and technical support;

• Supporting enablers to make greater energy efficiency possible;

• Providing customers with information and energy-saving tips; and

• Educating the public.

Goals and targets

The CLP Power Customer Service Quality Policy includes a commitment to support customers in using CLP products and services more efficiently and effectively.

In Hong Kong, CLP Power is regulated by the Scheme of Control Agreement (SCA). The SCA (2018–2033) includes:

1. Performance targets: Under the current SCA, targets are set to drive the performance of the CLP Eco Building Fund, the CLP Electrical Equipment Upgrade Scheme and energy audits in terms of energy saved per year, number of buildings or customers supported, etc.

2. Demand response programmes: This enables commercial and industrial customers to lower the overall system demand, resulting in a lower requirement for investment in new generation units in the long term. The program leverages artificial intelligence (AI) technology, developed by CLP strategic partner Autogrid to help manage the demand reduction. The target for this initiative is to achieve a reduction of up to 60MW from the demand peak.

3. A new five-year energy-saving target: CLP must achieve at least 4% of energy savings on the basis of average annual sales within a five-year period in order to earn incentives issued under the SCA. More incentives will be given if the energy saving reaches 5%.

GRI reference: 418-1

In Hong Kong, the Personal Data (Privacy) Ordinance (PDPO) governs the protection of personal data of individuals. The Data Protection Principles in the PDPO frame CLP Power’s obligations (as a data user) relating to the collection, accuracy, retention, use and security of personal data, as well as the rights to access and correct a customer personal data.

Under the Privacy Act 1988 (Privacy Act), EnergyAustralia has obligations to ensure the appropriate collection, use, disclosure and security as well as access to an individual’s own personal information. There are also mandatory data breach reporting obligations in relation to Notifiable Data Breaches. EnergyAustralia is required to report data breaches if there is unauthorised access to, unauthorised disclosure of, or loss of personal information that EnergyAustralia holds where this is likely to result in serious harm to one or more individuals and EnergyAustralia has been unable to prevent the likely risk of serious harm with remedial action. Notifications must be made to the Office of the Australian Information Commissioner (OAIC) and to the affected customers with description of the data breach, the kinds of information involved and recommendations for customers in response to the data breach.

In May 2018, the Australian Government announced that energy data would be included in the Consumer Data Right (CDR). The sharing of product data in the energy sector commenced on 1 October 2022 and consumer data sharing commenced on 15 November 2022. It gives customers the right to share certain of their transaction, usage and product data with service competitors and comparison services. EnergyAustralia was granted an exemption by the Australian Competition and Consumer Commission (ACCC) and must begin data sharing by 15 May 2023.

Strategy and procedures

The CLP Privacy Principles set out the Company’s commitment and approach to protecting personal data.

All employees who have to handle or process personal data of any individual for business operation in Hong Kong must follow CLP procedures, practices and local regulations in relation to personal data privacy. The Group preserves the confidentiality of the personal data provided to it in accordance with the CLP Privacy Policy Statement, which was updated with effect from 1 November 2018. The CLP Privacy Policy Statement demonstrates the Company’s approach to protecting personal data and is applicable to everyone across its entire operations who handles personal data.

In addition, business units with operations in Hong Kong must implement and abide by the CLP Personal Data Protection Compliance Manual which sets out CLP’s data protection compliance framework, including its governance structure and the roles and responsibilities of different functions under the governance structure. This manual also provides guidance on the protection and use of personal data. Adherence to policies and procedures regarding privacy and data protection are further embedded in CLP’s Code of Conduct and the compliance management procedures of the Code.

Monitoring and follow-up

CLP monitors and documents any complaints related to breaches of customer privacy and the loss of customer data. In addition to the CLP Personal Data Protection Compliance Manual, the Customer Success & Experience Unit has a written guideline for handling customer data incidents. The guideline includes the classification and assessment of the scope and severity of a data incident, reporting roles and responsibilities and the incident response strategy and checklist. The Corporate Data Protection Officer also retains a record of data incidents and follow-up actions.

EnergyAustralia has developed and maintains a Data Breach Response Plan which is implemented by a Data Breach Response Team. The plan outlines the strategy for assessing, managing, containing and reporting data breaches within required timeframes and outlines roles and responsibilities. It is enacted each time a potential data breach is identified.

Training and awareness

In further reinforcing CLP rules to protect customer information, a key focus has been the prevention of unauthorised disclosures to malicious attackers or impersonators. Specific awareness activities, including communications, quality assurance assessment, coaching and additional training for frontline staff, were carried out during the year. Company-wide communications, employee training and briefing sessions with leadership were also conducted to ensure all staff understand current privacy and data management obligations. A Data Breach Response Plan was formulated while a Data Breach Response Team was established to ensure the business has the capability and procedures in place to respond swiftly to such incidents.

Customer privacy may be compromised as a result of a cyber security incident, or by the mishandling of customer information by employees. A compulsory e-learning programme on data protection was given to all employees in 2020 and the e-training has been mandated since 2021 for all new employees.

In addition to this broadly received training, CLP runs tailored and frequent data protection awareness programmes through regular briefings, case sharing, quiz games and refreshers to employees who have regular interaction with protected data such as members of the Legal Review Committee. Industry threats are continuously reviewed with a view to strengthening controls on managing and monitoring networks, systems and mobile devices, data loss and suspicious cyber activities. CLP also regularly reinforces the need for timely reporting of potential privacy incidents.

At EnergyAustralia, customer privacy remains the focus of briefing sessions with leadership, enterprise-wide communications and employee training to ensure all staff are up-to-date with current privacy and data management. Privacy training is a compulsory requirement for all new employees and subsequent refresher training is provided to all employees annually.

GRI reference: 417-1

Strategy and procedures

CLP customers can access information on products and services in a timely and efficient manner through a number of communication channels, such as a welcome pack for new customers received by e-mail, information on the CLP Power websites and CLP Mobile App, as well as the EnergyAustralia websites and Mobile Apps. CLP also engages with residential, commercial and industrial customers through satisfaction surveys, online service portals, site visits to its assets, supporting by its account managers and Customer Service Centres and Customer Interaction Centre.  

CLP also strives to effectively respond to customer needs and preferences. All escalated cases are studied thoroughly to appropriately resolve the issues customers have raised.

EnergyAustralia averages one to two million conversations with customers every year, either over the phone or via digital service channels. It also engages with more than 100,000 individuals, businesses and stakeholders annually through formal research to help shape business decisions, products and services.

Monitoring and follow-up

In Hong Kong, an external market research consultant conducts an annual telephone survey. The customer satisfaction score considers overall satisfaction towards CLP and a relative rating against an ideal utility in Hong Kong. The score is benchmarked against the public utilities in the energy sector and other public service organisations.

In addition to the number of calls and complaints received, EnergyAustralia also measures customer satisfaction through its Strategic Net Promoter Score (SNPS). Customer satisfaction is measured monthly via an online NPS survey sent to a representative group of customers. The Transactional Net Promoter Score (TNPS) is also used to track customer satisfaction in relation to specific customer interactions, providing more direct feedback to frontline staff.

Strategies and procedures

CLP’s security strategy is guided by the CLP Risk Management Framework, with oversight from the Board. The Group Security Policy was updated in 2021 to define the overarching approach taken to minimise risk to people, including employees, contractors, customers and the public and to manage other business risks to acceptable levels. During 2022 all cyber security-related standards have been updated to take into account technological evolution, changing legislation and emerging good practice. Moreover, a fundamental review of strategy took place, allowing Security team to better place itself to support CLP Digital’s initiatives and the transition across the Group to the Utility of the Future.

The policy covers the following areas:

• Integrated and centralised organisation and governance: Security is an integrated department within CLP Digital which covers all relevant lines of security activity within the Company, operating independently of the IT and OT governing organisations.

• Policies, standards and guidelines: Providing a suite of documents guiding how to manage and monitor risks in line with recognised industry standards.

• Understanding the threats: Ensuring decisions related to the application of security measures are appropriately informed and, wherever possible, intelligence driven.

• Communications and awareness: Continuously enhancing the security awareness and knowledge of employees and contractors with the objective of encouraging security- positive behaviour.

• Technical domain: Ensuring that robust operational detection and response tools are developed, applied and maintained.

• Liaison: Maintaining constructive and trusted relationships with external stakeholders such as national cyber security agencies and industry bodies to ensure speedy and effective cooperation when the need arises.

There are five separate but co-dependent lines of activity, all of which are protected (to a lesser or greater extent) by cyber and physical security measures. These lines of activity are:

• Information: Data is stored in both hard and electronic formats. The confidentiality, integrity and availability of this data needs to be protected;

• Operational Technology (OT): Hardware and software that detects, monitors or controls physical devices (such as a turbine) at CLP assets, needs to be protected;

• Information Technology (IT): The IT used to store, retrieve, transmit and manipulate data or information needs to be protected;

• Personnel: Staff employed by CLP, both at the workplace and travelling for business, must be safe; and

• Brand: CLP’s image, identity and associated reputation needs to be protected.

CLP security measures are robust and scalable. They provide comprehensive, layered and flexible protection.

CLP's approach to security

Operational responsibilities

The Group Security team was established in 2020 to ensure cyber and physical security capabilities and efforts complement each other. The team offers an in-house capability across the full range of security skillsets. With internal re-structuring in 2022, the Group Security team was integrated into CLP Digital. This is a strategic move to support the transition to the “Utility of the Future”. The Security department remains separate from both the IT and the HSE departments but maintains close working relationships with both. Regular reports are provided by Group Digital to the Board’s Audit & Risk Committee (ARC). The ARC seeks assurance that adequate risk management is in place and followed and that appropriate remedial action is taken where needed.

GRI reference: 410-1

Strategies and procedures

Physical security refers to the physical measures designed to safeguard people, to prevent unauthorised access to equipment, facilities, material and documents and to safeguard them against security incidents. It covers physical barriers (e.g. fences), security lighting, physical access control and surveillance systems.

A body of work has been developed to assist all regions and their assets in establishing or revising their security management documentation. These documents are aligned with international standards for security and contain best practices derived from across the Group.

• The CLP Physical Security Standard lays down the minimum standard of physical security measures expected at every asset owned and/or operated by CLP, regardless of location or role.

• The CLP Physical Security Guideline provides practical guidance on the security requirements expected of all business units, in line with the Group Security Policy and Physical Security Standard. For instance, it includes guidelines on how to identify potential areas of weakness, develop appropriate security countermeasures, as well as prepare a security response plan.

• The CLP Security Vulnerability Assessment Guideline is the flagship document that lays down the process of evaluating the security status of any CLP site. Using a risk-based approach and in close collaboration with the operator, it provides a comprehensive security “health check” covering threats, areas of weakness and offers solutions.

• CLP’s Security Due Diligence for Project Design & Construction or Site Acquisition has been developed to support projects in the early stages of an acquisition or a build. Based on the premise that early identification of potential problems can reduce risk and the cost of retrospective correction, all projects and acquisitions undergo this process, regardless of size.

• The CLP Business Travel Risk Management Plan seeks to minimise the security, medical and health risks faced by employees engaged in business travel. On behalf of the Group, Security team in CLP Ditigal leads on business travel security in close cooperation with Group HR and Finance.

Training and awareness

CLP security staff play a key role in preventing harm to staff and the wider public. They are required to always comply with CLP’s Code of Conduct and receive related training on an annual basis. In addition to training on national regulations and site-specific requirements, contract security staff receive induction training on CLP’s policies including harassment-free workplace, minimum wage guidelines and measures preventing discrimination in the workplace. This induction training must be completed before personnel are granted access to their assigned workplace sites.

For a third successive year, business travel has all but stopped in response to the COVID-19 pandemic. More effort continues to be made in keeping staff across the Group informed on the rapidly changing travel situation and border closures across CLP’s portfolio countries and other key destinations, as well as providing bespoke advice to those who have needed it.

Strategies and procedures

Cyber security incidents are unique in that the attack occurs in a virtual space and may not cause immediate disruption, as in the case of data leaks, making them difficult to detect or trace. As the workplace and operations are increasingly digitalised, electronic devices could become vulnerable to cyberattacks. CLP therefore strives to protect the Operational Technology (OT) and Information Technology (IT) systems:  

• Operational Technology (OT) is the hardware and software that detects, monitors or controls physical devices (such as a turbine) belonging to CLP.

• Information Technology (IT) is the technology used to store, retrieve, transmit and manipulate data or information.

It is of utmost importance to improve the security culture within CLP and empower business units and regions to employ suitable technologies and processes to protect the Company’s assets and systems.

The management of cyber security is documented in two major Cyber Security policies, namely:

• The CLP Group Information Security Policy, which sets out the four key information security principles of confidentiality, integrity, availability and regulatory compliance. With reference to ISO/IEC 27002:2013 Information Technology Security Techniques – Code of practice for information security controls, a set of Group-level policies have been developed. Regional standards and procedures have been developed from these policies and tailored to suit the context and local regulations of the business unit; and

• The CLP Group Operational Technology Cyber Security Policy defines how to develop, implement and maintain appropriate safeguards to ensure the delivery of critical infrastructure services by CLP. One key focus relates to detection and response in cases of OT cyber security events and to establish recovery capability on the OT systems.

The department’s evidence-based reporting from internal testing provides an important feedback loop that enables the Company to pursue continuous improvement. In addition, the team helps project managers and business leaders understand cyber security risks in the context of CLP’s business and offers guidance on risk mitigation strategies.

Training and awareness

Our people are another focus in cyber defence. Every employee and associate of the Group is an important cyber defence asset. They need to be equipped with relevant knowledge to raise their awareness and vigilance.

CLP recognises the critical need to continually adapt and enhance its security posture to defend its operations against a complex and dynamic threat spectrum. Insight into the capability and intent of cyber attackers will help CLP develop situational awareness and it offers direction on what measures need to be taken to mitigate associated risks. Continual effort is given to raising cyber security awareness, training and education amongst employees to help them practise good “cyber hygiene”.

Security awareness activities at the employee level have included: simulated phishing emails, internal broadcast campaigns, briefings, videos and the introduction of ‘Cyber Champions’ to promote good cyber practice across a range of departments and functions.

Monitoring and follow-up

CLP continually monitors its IT systems and networks and also seeks out threats to its OT systems. Advances in cyber security technologies have helped improve the detection of cyber security breaches. If suspicious activity is discovered in the IT or OT network environments, immediate action is taken to investigate it and, if necessary, isolate the threat and lead the recovery action.

Strategies and procedures

CLP maintains robust and regularly tested emergency response and crisis management procedures. As the first line of defence, when an incident arises the Incident Management Process (featured below) is followed.

CLP Incident Management Process

Crisis Management Plan

Guided by the Group Crisis Management Plan, CLP ensures high levels of preparedness to respond to and recover from any emergency situations and helps minimise disruption to customers. The Plan is continually reviewed and enhanced to ensure it is in line with operational changes or the broader operating context. It provides a platform for the effective handling of a crisis at the Group level. The plan:

• Outlines crisis management organisation, roles, responsibilities, procedures and processes;

• Specifies the tools needed to ensure the collective response is well planned, well executed and fully integrated across the organisation;

• Describes the relationship and interface between the handling of regional- and Group-level crises; and

• Details the processes that govern internal and external communications during emergencies and crises, ensuring our people who are responsible for managing a crisis have the necessary information to carry out their responsibilities and that key stakeholders are informed.

The Group-level plan is supported at regional level by Regional Crisis Management Plans which mirror the Group document but are tailored for each region. In addition, detailed emergency response plans have been developed for each asset. These plans are designed to be used by first responders and asset managers.

CLP’s Crisis Management & Emergency Response Structure are outlined in the diagram below.

CLP Crisis Management & Emergency Response Structure

Training and awareness

As specified in both Group and regional publications, emergency response drills are conducted at least annually at all Group sites, with smaller scale drills taking place more often. Group and Regional Crisis Management Plans are reviewed at least every three years. Regional crisis management exercises are conducted annually as part of the internal peer review process.