Resiliency and ERM, by Dow's John Sampson at ARC World Industry Forum 2013

I'll tell you a little bit about who we are. We're a 116-year-young company, started 116 years ago in Midland, Michigan, by H.H. Dow, our founder. He came there because he found a better way to make bleach, which was our first product we ever sold. So you might ask yourself, why the heck would you go to Midland, Michigan, to make bleach? Turns out that there's only a certain number of places in the world that have salt formations, and Michigan happens to have a very large salt formation. That's a key raw material in making bleach or chlorine, which is a precursor to making bleach. And so that's how we ended up there, and we're still there today. So a bleach product 116 years ago has morphed into 5,000 products, a couple hundred manufacturing sites in over 30 countries.

And we've been around and transformed through those 116 years. Initially, our enterprise risk management system was really around keeping stuff in the pipes and making sure our plants were running effectively. But it's broadened since then to really encompass a lot of what Peter showed you there in terms of all the different facets of enterprise risk management. And lately, it's really been about resiliency—understanding that things will happen, things will go wrong, and you need to be ready for the inevitable.

We certainly are trying to avoid the headlines, and so the whole idea around enterprise risk management is to stay out of the headlines, at least on the negative side of things. You know, and I think about this and putting this slide together. Ten years ago, you would have had to have had all black-and-white pictures of things that happened two decades ago and all these things to put this slide together. Today, my God, this slide's even outdated, right? I could have the slides showing the Carnival Cruise Ship up there. Okay, so clearly they had enterprise risk management in their overall philosophy, right? They said, well, if an engine fire happens, we want to have a halon system to put the fire out—step one. Now what? Okay, now you've got 4,000 people out there. You've had an engine fire, you put the fire out, you dealt with the first unplanned event, but now what are you going to do? I'm sure that in their planning they didn't say, well then we'll let's see, we'll call a tugboat out and we'll take a couple of days and we'll pull them back to Alabama. So I don't think that was part of the plan. If it was, I'm sure they didn't anticipate the kind of negative publicity that they're getting on an hourly basis as CNN continues to remind us that there are 4,000 people out there floating, okay, because they had an engine fire and their plan was we'll pull them back to Alabama with a tugboat. So you've got to stay out of the headlines, folks. When you're in the business, and in the chemical business, you really need to stay out of the headlines. And so we've elevated our game to include resiliency in making sure that when things happen, we can be resilient.

You know that you don't have to look very far back to talk about companies that actually have had issues, had unplanned events, and then were faced with situations where they really couldn't recover—whether that was Enron or WorldCom or what have you. These companies had issues with risk management inside of their organization, and then they were physically unable to recover. And what happened in those cases, in many cases, what I found when I looked at an article from Booz & Company was that 80 percent of the time it was just poor mismanagement of strategic risk. So it's the executives missing an opportunity to participate in this process. You can't just delegate risk management; you have to participate because there's a part to play for executives in this. At Dow, we believe in that, and in fact, I participate on a team with some key executives where we're looking at corporate risk at a company level and ensuring that all phases and facets of enterprise risk management are being dealt with effectively.

So really, you know, resiliency is about bridging the gap between the experts who are managing the IT risks, they're managing the process risks, they're managing their R&D risks, and the senior leaders who are managing strategic risks. What markets are we going to go into? What products are we going to develop and market? And have we really thought about is this the right way to go as a company? Certainly, those that have had these issues and disruptions in their markets and businesses that didn't have that fell by the wayside. And there are really three things that you really have to do: you've got to broaden your awareness and really understand what it really means to look at it at an enterprise-wide level, you've got to integrate risk awareness into your strategic decision-making, and you've got to focus on resiliency.

And this isn't just in the industry, in the chemical industry or in industry in general. Even the governments are looking at this. And in fact, Suzanne Spalding, Deputy Homeland Security Under Secretary, in a recent speech made comments to the issues and the need for resilience—okay, the ability to adapt to changing conditions and to prepare for, withstand, and rapidly recover from disruption. So they're looking at critical infrastructure across the U.S.—train systems, bridges, water systems. What happens when things do break? How resilient are you? Can you make the necessary recovery happen in a fast and efficient manner? We partner with Homeland Security on many fronts to really understand how we play a role in overall enterprise reliability and resiliency of both their critical infrastructure and our role as the largest chemical company in the U.S.

So ERM for Dow has really kind of evolved over the years. Initially, it was a gut feel—boy, it sure would be good if we had this, it feels like this would be the right thing to do—to much more of a database, rudimentary model system, more proactive, to today where it really is highly data-driven and highly integrated enterprise-wide with resiliency built in. This picture just shows you kind of the different layers in which we practice this. Again, at the very top, that's where a lot of companies miss the mark. If your senior executives are not involved in strategic business management and enterprise risk modeling, then you're missing the mark. Everyone practices compliance and financial reporting ERM, everyone makes sure that their plants are not blowing up or doing things to harm the environment, okay? But you really need those senior execs participating in those top three layers of this process to really have a robust system that will be resilient.

And we integrate all the way through the board of directors. In fact, we've got an EHS and Sustainability Board of Directors subcommittee, and the senior executive team that I participate on is accountable to that group to make sure we explain to them where the greatest risks are for the Dow Chemical Company and what we're doing to put in mitigation strategies. We, of course, in turn then turn to our topic owners and SMEs to make sure that they're doing the kind of risk management and modeling that they need to do, and then they turn to the process owners to make sure those processes are in place. It's a top-down, bottom-up approach.

The other key part of this is that you have to be able to get information in from all different sources. Anyone and everyone, whether it's the 50,000 employees or the 50,000 contract partners that work with us on a day-by-day basis, anyone can bring about and raise a risk that you may need to evaluate. So you have to make sure that everyone feels accountable for being a part of the process, everyone feels accountable for escalating if they see something they don't like. That's an important part of our culture. And so we gather input from our board members, we gather input from our contract partners, anyone who's got something they want to raise, we funnel that through and make sure it's been properly evaluated to raise the level of awareness on any particular risk. And you have to partner with outside organizations and come to conferences like this really to get your outside perspective and really understand what's happening. You can't be insular.

So just like the slide that Peter showed earlier, you know, it's not just about the plant, okay? It's about financial, it's about information systems—which this organization, of course, is very aware of—it's about business management, governance, and external environment. All of these are parts and pieces and components of a robust, resilient enterprise management process. And around the product, we do manage across the life cycle from innovation, where we've got processes in place to understand what we're first trying to invent a product, to the actual planning for procuring the raw materials. You know, I'd like to tell you across the 5,000 products that we have triple redundancy on all raw materials, but that's just not true. We do have, out of those 5,000, a few that are single-sourced, and that's okay—you can have that, but you better have a robust mitigation plan for if that single source fails, okay? And then you get into the actual manufacturing piece, and that's probably where we're the strongest, we're the deepest, we've been doing it the longest—keeping things in the pipe, making sure we're doing things excellent from an environmental perspective. And then you've got the product side, and there are processes in place to make sure our product risk management is in place, along with transportation risk around supply chain, and then handling the product at the customer's shop, and then finally waste management—all different facets of a product life cycle that require, again, a robust set of tools in place so you can understand the risk associated with those items and then manage the risk appropriately.

Not to say we haven't been through our own stress tests. So we've been tested in many different ways and on many different occasions. It's inevitable, you know, things aren't going to always go well. And each time, across 116 years, we've been able to respond appropriately because we've had, again, a robust set of plans in place to deal with the unexpected.

So in today's world, some of the key factors for success: make sure you've got an enterprise-wide approach—that's a given. Make sure you're anticipating the risk and making sure you've got mitigation plans in place before things get disrupted. Manage the risk so that as you grow, you're growing in the right direction. This gets back into strategic risk mitigation. And then make sure you're doing it better than the competition. That's very important because it's what we were founded on 116 years ago when H.H. Dow went into the bleach business is because he thought he had a better way to make bleach. And as he used to say quite often, if you can't do it better, why do it? And so you really need to be excellent at this to have a competitive advantage.

So key questions to ask yourself: where are you on this continuum of getting your enterprise risk management and resiliency built into your organization? Okay, are you resilient and proactive, or are you saying, well, step one, put the fire out in the engine room, step two, call the tugboats? Okay, so you don't want to end up in that situation, okay? Are your employees, leaders, and everyone in your organization—everyone who has a potential observation to make in terms of risk—are they willing and able to escalate, come forward, and bring that forward into your organization so you can evaluate it and decide what you need to do? Sometimes if we need to do nothing, other times it's something that needs to be evaluated and dealt with. So with that, I'll turn it back over to Peter. Thank you.