Part of our plan to deliver long-term value to our consumers and shareholders is our strong oversight and risk management approach. Our enterprise risk management (ERM) process involves systematic risk identification, assessment, mitigation and monitoring, covering enterprise, strategic, financial, nonfinancial, operational, compliance and reporting risks. The Board of Directors oversees the ERM process and reviews a comprehensive enterprise risk assessment and prioritization process each year.

Our company’s Executive Committee is accountable for ensuring enterprise risks are being effectively managed. Our ERM process is driven by our Enterprise Risk Committee (ERC) — which is sponsored by our chief financial and administrative officer (CFO/CAO) and composed of senior leadership within Legal, Accounting, Treasury and Internal Audit.

As part of its oversight responsibilities, the ERC undertakes an annual risk assessment in conjunction with the company’s annual budgeting cycle and with input from the company’s Executive Committee. The risk assessment then bifurcates risks into expected and extraordinary risks. Expected risks are governed by the ERC and existing management processes, such as monthly operational reviews.

The ERC categorizes extraordinary risks into high, medium and low priority based on likelihood of occurrence and degree of impact. The ERC then assigns an executive-level owner for each risk, with responsibility for monitoring and appropriately managing the assigned risk.

For example, the ERM process identified a plant shutdown due to a significant supply chain disruption as an extraordinary risk. The ERC assigned the Executive Committee as the owner of the risk, and mitigation plans — including driving our dual-sourcing program and competitive and resilient supply chain initiative — are to be driven by our head of strategic sourcing. As a second example, cyber system failure was identified as an extraordinary risk, with assignment of the risk to our chief information officer. System monitoring mitigation plans are driven by our CFO/CAO and our chief information officer, while cyber incident mitigation plans involving cyber insurance are driven by our CFO/CAO and our corporate treasurer.

The ERC meets at least four times a year to review significant risks facing the company and ensure those risks are being managed appropriately. Risk assessment and mitigation plans are reviewed and aligned with the company’s Executive Committee, and performance is monitored throughout the year, both by the ERC itself and by Internal Audit. The Board and its committees review and receive updates on the 14 categories of risk throughout the year. The Board also reviews the ERM system holistically each year. The risk management process is subject to review by the ERC with support from Internal Audit and our external auditor every two years.