Carl WirdakOccidental Petroleum Corporation

GEMI Survey

EHS Risk Management

October 2001

RISK MANAGEMENT 2

Outline

• Survey Recap• Risk policy and program features• Risk assessment process

– what is covered– how is risk assessed

• Information and communication• Risk management process responsibilities• Risk management outcomes

RISK MANAGEMENT 3

Survey Overview

• Survey covers the management of environment, health or safety (EHS) related risk as it applies to a company’s business activities (i.e., manufacturing, transportation/distribution, product formulation and

use, etc.). • Survey response rate = 69%

– 27 companies responded to the survey– Not all companies completed all questions

• Broad industry coverage– Chemicals, semiconductor, oil/gas, consumer products,

pharmaceuticals, food/beverage, forest products, energy, transportation, etc.

RISK MANAGEMENT 4

Risk Policy

• >95% of respondents have an internal policy or guidance document that directs efforts to identify / manage EHS risks

• Most risk management programs are formal

• Acceptable risks are established on a case-by-case basis, rather than by setting “bright-line” or unequivocal limits

RISK MANAGEMENT 5

Risk Policy

Majority require that all risks be identified and managed

Risks Identified

Yes73%

No27%

Risks Managed

Yes81%

No19%

RISK MANAGEMENT 6

Risk Assessment - Scope

• All respondents do EHS compliance audits– 80% of respondents covered by a legally

mandated risk management requirement (OSHA PSM / EPA RMP)

• 88% of respondents conduct EHS risk assessments and all of these address risk issues that go beyond regulatory compliance

RISK MANAGEMENT 7

Risk Assessment - Focus

Physical risks appear to be the primary focus

Safety & Health

Environment

Legal

PoliticalFinancial

Operational

BusinessInterruption

RISK MANAGEMENT 8

Risk Assessment - Process

• 67% have written procedure that provides a method for categorizing EHS risks

• 50% say the methodology for categorizing PSM / RMP related risks is different than for all other types of risk

• 43% force rank different types of EHS risks on a common scale

Safety & Health

Environment

Legal

Operational

Financial

Political

Business Interruption

0 50 100

RISK MANAGEMENT 9

Risk Assessment - Process

What methodology is used?

22%

67%

11%

Qualitative

Semi-QuantitativeQuantitative

Who applies the criteria for acceptable risk?

38%38%

24%

Facility

Corporate

Division/BU

RISK MANAGEMENT 10

Information / Communication

• 84% of respondents address inherent EHS risks of operations

• 92% report on risks that go beyond those areas covered by PSM / RMP

• Nature of risk discussion

• 83% include mitigation opportunities

• 59% document risks left unmitigated

Qualitative Combination Quantitative56% 35% 9%

RISK MANAGEMENT 11

Information / Communication

0

10

20

30

40

50

60

70

80

90Facility

Division/BU

Corp EHSLegal

Corp Mgmt

Inventory Report

• Facility, Corp EHS and Legal “know” the risks

• Risk information communicated to Division/BU management

• Corporate management does not receive risk information

RISK MANAGEMENT 12

Information / Communication

• Legal Department involvement– 80% of companies have legal input– Risk assessment team member or report

reviewer (sometimes directs the team)

• Twice as likely (40%) to have outside counsel involved in risk assessments versus EHS audits

Risk Inventories EHS Audit40% 65%

• Apply audit privilege

RISK MANAGEMENT 13

Responsibilities

0

50

100Line Mgmt

Legal

FinanceRisk Mgmt

EHS

Identification Management

• Identification and management of EHS risks rests with line management and facility, division, or corporate EHS staff

RISK MANAGEMENT 14

Responsibilities

0

50

100Facility

Line Mgmt

EHSOther/Legal

Consultants

Conducts Validates

• EHS and (to a lesser degree) other facility staff are primarily responsible for conducting and validating the risk analysis

• Where corporate EHS is not involved in risk analysis, more than 25% of respondents do not validate the output

RISK MANAGEMENT 15

Headcount

All Risk Management Staff

0

5

10

15

20

25

0 10 20 30 40 50

Revenue ($ billions)

FT

E/$

bil

lio

n

Risk Management Expert Staff

0

1

2

3

4

5

0 10 20 30 40 50

Revenue ($ billions)F

TE

/$ b

illi

on

RISK MANAGEMENT 16

Outcomes

• 80% of companies require identification and prioritization of risks

• Only 45% require elimination of risk

• Line management is responsible for choosing accepting risks

• Popular 3rd party insurance:– Operational– Business Interruption– E, S, H

No Yes

All Risks Eliminated

No

All

Ris

ks Id

entif

ied

/ Ma

nag

edY

es 118

32

Number of Companies

RISK MANAGEMENT 17

Outcomes

• Benefits of EHS risk management– Lower risks– Reduced potential liabilities– Improved EHS performance– Enhanced EHS legal compliance– Lower EHS costs and lower insurance costs– Enhanced management awareness – Safer products – Smoother ISO 14000 registration– Satisfy stakeholder expectations– Created new customer service opportunities

RISK MANAGEMENT 18

Outcomes

• Emerging areas of risk management• Sustainability• Social Responsibility• Company and brand reputation• Community relations

• Persistent chemicals• Biosafety• New issue management

RISK MANAGEMENT 19

Questions / Comments

• We assess existing risks to find ways to avoid conditions and designs that create significant future risk.

• We use our life cycle management process, EHS management system plus RMP/PSM and EHS audits to control risk.

• Has any company outsourced the risk analysis function?

• Are companies considering a transparent, full disclosure policy or participation (by NGOs, etc.) on company risk assessments?

• How well do companies utilize their risk evaluations related to intangible assets for financial analysts?