GEMI Survey EHS Risk Management October 2001 Carl Wirdak Occidental Petroleum Corporation

Outline Survey Recap Risk policy and program features Risk assessment process what is covered how is risk assessed Information and communication Risk management process responsibilities Risk management outcomes RISK MANAGEMENT

Survey Overview Survey covers the management of environment, health or safety (EHS) related risk as it applies to a company’s business activities (i.e., manufacturing, transportation/distribution, product formulation and use, etc.). Survey response rate = 69% 27 companies responded to the survey Not all companies completed all questions Broad industry coverage Chemicals, semiconductor, oil/gas, consumer products, pharmaceuticals, food/beverage, forest products, energy, transportation, etc. RISK MANAGEMENT

Most risk management programs are formal Risk Policy >95% of respondents have an internal policy or guidance document that directs efforts to identify / manage EHS risks Most risk management programs are formal Acceptable risks are established on a case-by-case basis, rather than by setting “bright-line” or unequivocal limits RISK MANAGEMENT

Risk Policy Majority require that all risks be identified and managed RISK MANAGEMENT

Risk Assessment - Scope All respondents do EHS compliance audits 80% of respondents covered by a legally mandated risk management requirement (OSHA PSM / EPA RMP) 88% of respondents conduct EHS risk assessments and all of these address risk issues that go beyond regulatory compliance RISK MANAGEMENT

Risk Assessment - Focus Physical risks appear to be the primary focus RISK MANAGEMENT

Risk Assessment - Process 67% have written procedure that provides a method for categorizing EHS risks 50% say the methodology for categorizing PSM / RMP related risks is different than for all other types of risk 43% force rank different types of EHS risks on a common scale RISK MANAGEMENT

Risk Assessment - Process RISK MANAGEMENT

Information / Communication 84% of respondents address inherent EHS risks of operations 92% report on risks that go beyond those areas covered by PSM / RMP Nature of risk discussion 83% include mitigation opportunities 59% document risks left unmitigated RISK MANAGEMENT

Information / Communication Facility, Corp EHS and Legal “know” the risks Risk information communicated to Division/BU management Corporate management does not receive risk information RISK MANAGEMENT

Information / Communication Legal Department involvement 80% of companies have legal input Risk assessment team member or report reviewer (sometimes directs the team) Twice as likely (40%) to have outside counsel involved in risk assessments versus EHS audits Apply audit privilege RISK MANAGEMENT

Responsibilities Identification and management of EHS risks rests with line management and facility, division, or corporate EHS staff RISK MANAGEMENT

Responsibilities EHS and (to a lesser degree) other facility staff are primarily responsible for conducting and validating the risk analysis Where corporate EHS is not involved in risk analysis, more than 25% of respondents do not validate the output RISK MANAGEMENT

Headcount RISK MANAGEMENT

All Risks Identified / Managed Outcomes 80% of companies require identification and prioritization of risks Only 45% require elimination of risk Line management is responsible for choosing accepting risks Popular 3rd party insurance: Operational Business Interruption E, S, H No Yes All Risks Eliminated All Risks Identified / Managed 11 8 3 2 Number of Companies RISK MANAGEMENT

Outcomes Benefits of EHS risk management Lower risks Reduced potential liabilities Improved EHS performance Enhanced EHS legal compliance Lower EHS costs and lower insurance costs Enhanced management awareness Safer products Smoother ISO 14000 registration Satisfy stakeholder expectations Created new customer service opportunities RISK MANAGEMENT

Emerging areas of risk management Outcomes Emerging areas of risk management Sustainability Social Responsibility Company and brand reputation Community relations Persistent chemicals Biosafety New issue management RISK MANAGEMENT

Questions / Comments We assess existing risks to find ways to avoid conditions and designs that create significant future risk. We use our life cycle management process, EHS management system plus RMP/PSM and EHS audits to control risk. Has any company outsourced the risk analysis function? Are companies considering a transparent, full disclosure policy or participation (by NGOs, etc.) on company risk assessments? How well do companies utilize their risk evaluations related to intangible assets for financial analysts? RISK MANAGEMENT