RISK MANAGEMENT FRAMEWORK RISK IDENTIFICATION PROCESSES A EMERGING

RISK MANAGEMENT FRAMEWORK RISK IDENTIFICATION PROCESSES A. EMERGING AND UNKNOWN RISK SIGNALS B. S. C. RISKS (VIA TEAMS AND SURVEYS) C. PROJECT RISKS (PM SYSTEMS AND CRISES LEARNINGS § MODIFY ANALYTICS § MODIFY SCREENING § ID NEW SIGNAL SOURCES OTHER) D. RISK TREATMENT EFFECTIVENESS OUTPUTS SUPPLY CHAIN LEADERSHIP SUPPLY CHAIN RISK DASHBOARD MONITOR RISK TREATMENT EFFECTIVENESS RISK ANALYTICS & DECISION SUPPORT ANALYZE EVALUATE PRIORITIZE INSTALL MONITORING POINTS SYSTEMATIZE MONITORING HOLISTIC VIEW OF RISKS IMPLEMENT ACTIONS AND/OR FACTOR RISKS INTO PLANNING* § § “SUPPLY CHAIN RISK” MANAGEMENT TEAMS (multi-functional members)) Deep dive analysis of specific strategic risk Implement risk treatment for new operational risk Take action to leverage upside of an emerging risk Modify strategy based on risk landscape * examples of possible actions, not all-inclusive ERM Committee

SUPPLY CHAIN RISK WORLD Unique and common risk events exist across the supply chain and at each organizational level Identified risk events are analyzed for probability and consequence, thereby defining the risk level Assessed risks are evaluated and risk treatment options are developed Risk treatment is optimized, implemented and monitored Strategic risks are generally out of our direct control, and must be factored into business planning. Operational risks are generally within our direct control, and must be factored into business operations. LIC PUB TION CEP PER MATERIAL QUALITY COST MATERIAL AVAILABILITY Buy INBOUND LOGISTICS CLI M CHA ATE NGE COUNTRY STABILITY AL NATUR DS R HAZA CONVERSION EFFICIENCY Make WATER USE ENERGY USE WATER AVAIL ABILIT Y NGO’s & SIG’s PRODUCT QUALITY WATER QUALITY WORKER SAFETY PACKAGING WASTE ULA ACT TORY ION S PRODUCT SAFETY Move ENVIRONMENTAL COMPLIANCE REG PRODUCT SECURITY Sell OUTBOUND LOGISTICS AGING PACK ME VOLU Note: risks listed above are indicative of the scope of supply chain risks and risk areas, and may not include all risks Demand § §

RISK MANAGEMENT DEPLOYMENT AT EACH LEVEL AND ENTITY A Risk Register is created and managed at each level and entity, and identified risks are incorporated into on-going business routines Develop Initial Risk Register TOP-DOWN AND BOTTOM-UP VISIBILITY TO RISKS (TRANSPARENCY) GROUP RISKS BUSINESS UNIT RISKS COUNTRY RISKS ARE ASSESSED AND OPTIMIZED AT THE LOCALLY RELEVANT LEVEL, AND AGGREGATED UPWARDS THROUGH THE ORGANIZATION CORPORA TE RISKS § Use historical and current risk assessments, maybe supplemented by surveys § Perform high-level ranking and screening to identify significant risks One-time Perform Risk Analyses § Bow-tie method to identify causes, consequences § Identify existing and new risk treatments § Establish risk owner and action items § Link to other risks in system § Refine risk register Initial analyses, then as-needed Quarterly Risk Team Reviews § Review action item status § Review emerging and new risks § Review effectiveness of existing risk treatment § Perform new or review existing risk analyses § Update and refine risk register Quarterly meetings to supplement business meetings Factor Risks into Business Planning § Ensure strategic and operational risks are considered in annual business planning § Use risk information in on-going business processes Annual basis aligned with business planning