“Supply Chain Risk” Management Teams ( multi-functional members )

1. Risk Management Framework Strategic Risks Emerging Risks Operational Risks • Crises Learnings • Modify Analytics • Modify Screening • ID new signal sources Risk Identification Processes a. Emerging and unknown risk signals b. S. C. risks (via teams and surveys) c. Project risks (PM systems and other) Supply Chain Leadership d. Risk treatment effectiveness outputs Supply Chain Risk Dashboard MONITOR RISK TREATMENT EFFECTIVENESS INSTALL MONITORING POINTS SYSTEMATIZE MONITORING RISK ANALYTICS & DECISION SUPPORT ANALYZE EVALUATE PRIORITIZE Holistic View of Risks “Supply Chain Risk” Management Teams (multi-functional members) • Implement Actions and/or • Factor Risks into Planning* • Deep dive analysis of specific strategic risk • Implement risk treatment for new operational risk • Take action to leverage upside of an emerging risk • Modify strategy based on risk landscape ERM Committee * examples of possible actions, not all-inclusive

2. Supply Chain Risk World • Unique and common risk events exist across the supply chain and at each organizational level • Identified risk events are analyzed for probability and consequence, thereby defining the risk level • Assessed risks are evaluated and risk treatment options are developed • Risk treatment is optimized, implemented and monitored Strategic risks are generally out of our direct control, and must be factored into business planning. Operational risks are generally within our direct control, and must be factored into business operations. External (Strategic) Risks COUNTRY STABILITY NATURAL HAZARDS NGO’s & SIG’s PUBLIC PERCEPTION REGULATORY ACTIONS Internal (Operational) Risks PRODUCT QUALITY CONVERSION EFFICIENCY MATERIAL QUALITY MATERIAL AVAILABILITY PRODUCT SECURITY PRODUCT SAFETY Demand COST OUTBOUND LOGISTICS INBOUND LOGISTICS WATER USE ENVIRONMENTAL COMPLIANCE WORKER SAFETY ENERGY USE CLIMATE CHANGE PACKAGING VOLUME WATER AVAILABILITY PACKAGING WASTE WATER QUALITY Note: risks listed above are indicative of the scope of supply chain risks and risk areas, and may not include all risks

3. Risk Management Deployment At Each Level and Entity Corporate Risks Top-down and bottom-up visibility to risks (transparency) • Develop Initial Risk Register • Use historical and current risk assessments, maybe supplemented by surveys • Perform high-level ranking and screening to identify significant risks One-time Group Risks • Perform Risk Analyses • Bow-tie method to identify causes, consequences • Identify existing and new risk treatments • Establish risk owner and action items • Link to other risks in system • Refine risk register Initial analyses, then as-needed Risks are assessed and optimized at the locally relevant level, and aggregated upwards through the organization Business Unit Risks A Risk Register is created and managed at each level and entity, and identified risks are incorporated into on-going business routines • Quarterly Risk Team Reviews • Review action item status • Review emerging and new risks • Review effectiveness of existing risk treatment • Perform new or review existing risk analyses • Update and refine risk register Quarterly meetings to supplement business meetings • Factor Risks into Business Planning • Ensure strategic and operational risks are considered in annual business planning • Use risk information in on-going business processes Country Risks Annual basis aligned with business planning