Complacent or Complicit?
Executives’ Lack of Proper Risk Governance Is Putting Their Businesses in Jeopardy
Despite overwhelming evidence of the business disruptions
that occur from failing to manage today’s various risks,
company executives appear complacent and fail to adequately
account and prepare for those risks that can have potentially
catastrophic implications, according to DuPont Sustainable
Solutions’ (DSS) annual global operational risk management
survey of executives. Being unaware of future risks can lead
to an event resulting in significant reputational loss for the
company. This is an alarming trend, that if not changed,
threatens the future of the very companies these executives are
entrusted to lead.
Findings from the DSS survey reveal:
Executives Are Not Putting Sufficient Emphasis on Risks
1 that Can Lead to Large-Scale Incidents
Executives Address Gaps in Risk Management Processes
2 by Adding More Processes
Executives Confirm Disconnect Among Personnel
3 in Managing Risk
Running a successful business is more complex and challenging
now than ever before. The average tenure of companies on the
S&P 500 is steadily declining, from 37 years in 1980 to 24
years in 2016 and is projected to be just 12 years by 2027.1 In
this context, it is clear executives need to more effectively adapt
to the various forces and risks impacting their organizations.
Old ways of looking at risk are insufficient in today’s global
business environment if executives want their organizations to
be successful.
Executives today must effectively manage risks arising from
numerous sources both within and outside an organization.
Coordinating the operations of various facilities spread
across different geographical regions; adjusting to changing
international trade regimes and regulations; anticipating
the impacts of natural disasters on business operations; and
managing dynamic global supply chains and price pressures
on key commodities are just a few of the challenges faced by
today’s company leaders. With these challenges come a host of
associated new risks that executives must successfully anticipate
and mitigate if they do not want to threaten their company’s
operational performance, business continuity, right to operate,
and ability to deliver consistent value to shareholders.
1
“2018 Corporate Longevity Forecast: Creative Destruction is Accelerating,” Innosight, February 2018
EXECUTIVES ARE EXHIBITING A DANGEROUS Additionally, many of the surveyed executives, particularly at
AMBIVALENCE TOWARDS RISK MANAGEMENT the levels of Board of Directors and Executive Committee,
are not looking at leading indicators of future risks that can
The findings of DSS’ 2018 global operations risk management
negatively impact the company and threaten their right
survey of executives show that while there is general agreement
to operate. Instead, executives are paying more attention
and acknowledgement among participating executives of the
to lagging indicators that reflect the immediate concerns
importance of a comprehensive, successful risk management
impacting the profitability of the organization in the short
program, leaders are in practice failing to implement such a
term. This is a recipe for enabling small problems that can be
program effectively within their organizations. This failure is
easily remedied to become significant events that threaten
manifesting in the following ways:
operations and an organization’s competitive edge.
1. Executives Are Not Putting Sufficient Emphasis on
For example, respondents from among some of the most
Risks that Can Lead to Large-Scale Incidents
hazardous industries do not appear to place enough value on
While 78 percent of executives participating in the survey agree leading indicators reflecting asset reliability, even though such
that low incident rates do not correlate to reduced risk, two- leading indicators provide executives with an early look at
thirds of them nevertheless acknowledge feeling safe when they future operational problems and vulnerabilities that are much
see data indicating incident rates are low or trending toward easier and less costly to fix sooner rather than later. The data
zero. Executives appear to be allowing low incident rates to give shows that if we look strictly inside the boardroom, issues such
them a false sense of security and are ignoring other indicators as financial matters and regulatory compliance are the top two
of potential significant events. Of course, working toward topics discussed by directors. Asset integrity/reliability, supply
safe daily operations is an important goal for organizations, chain integrity, and process safety are the least discussed topics.
but executives should not confuse “safety” with “risk.” While
employee safety is one part of an organization’s risk profile,
there are numerous other risks that executives should be aware
of, particularly those such as aging assets or natural disasters
TOP 3 TOPICS DISCUSSED IN BOARDROOM
that can lead to catastrophic events. Based on the survey
findings, executives appear disproportionately concerned with
incident rates despite a realization that other risks exist that
can have significant disruptions to the business. This focus on
€ $ FINANCIAL 87%
incident rates and short-term impacts, instead of the company’s
broader risk profile, indicates a reactive, narrowly focused
mindset that fails to take into account other long-term risks
REGULATORY
COMPLIANCE 69%
that threaten the organization.
ORGANIZATION
& OPERATIONS 60%
“ We measure accident rate, lost time and
near misses.”
VICE PRESIDENT, MANUFACTURING INDUSTRY
BOTTOM 3 TOPICS DISCUSSED IN BOARDROOM

For example, data relating to an organization’s incident

ASSET INTEGRITY/
RELIABILITY 40%
29%
rates have nothing to do with external risks to the company
CONTRACTOR
from potential cyber-attacks, such as the 2017 “WannaCry”
ransomware attack that forced automakers Renault and Nissan
MANAGEMENT
to idle some of their European facilities.2 Similarly, incident
rates do not apply to risks to an organization’s supply chain.
This year, for example, a major fire at an automotive parts
POLITICAL
MATTERS 28%
supplier significantly disrupted output at General Motors,
Fiat Chrysler, and Mercedes-Benz facilities, and forced Ford These findings are identical to those of last year’s survey. It is no
Motor Co. to temporarily lay-off 3,600 workers and suspended wonder 40 percent of surveyed executives feel they do not have
production affected an additional 4,000 employees.3 a good understanding of their company’s risk profile.
2
“European Car Plants Halted by WannaCry Ransomware Attack,” NBC News, May 15, 2017
3
“Ford, GM, FCA, Mercedes and BMW production hit by U.S. parts plant fire,” Automotive News Europe,
May 9, 2018
2. Executives Address Gaps in Risk Management Processes
by Adding More Processes
Executives participating in the survey agree on the importance
of having systems in place to successfully manage risks that are
integrated, complement each other, and are regularly reviewed for
efficiency and effectiveness. Yet these executives admit that one of
the biggest challenges they face are gaps in processes.
Forty four percent of executives participating in the survey admit
that gaps in their existing systems present a challenge for their
organizations. Additionally, executives acknowledge some of their
existing internal procedures are insufficient to manage current
risks. For example, 40 percent of surveyed leaders expressed
challenges with effective employee performance management. This
lack of integration between systems, processes, governance and
employee training could result in failures in assets, process safety
issues, as well as increased injuries and catastrophic incidents.
CHALLENGES FACED BY RESPONDENTS
Gaps in Processes
44%
Ineffective Performance
Management 40%
Leadership/Workforce
Misalignment 37%
Lack of Capability
37%
Inappropriate
Mindset/ Behavior 36%
Executives participating in the survey also agree that processes
and systems alone are inadequate to manage risk and ensure
operational and business performance, yet in practice they admit
to attempting to drive better performance by simply expanding
existing or implementing new processes and requiring all personnel
to adhere to them. Adding new procedure on top of procedure
increases operational complexity, which not only adds risk to the
company, but is unsustainable to the organization over the long
term. In DSS’ experience, the top concern of CEOs around the
world is that their operations are too complex. Processes should
be simplified as much as possible and the focus should be on
operationalizing them; that is, making sure every employee realizes
why each process is important and providing them the training
necessary to execute it effectively and easily rather than simply
adding it to a list of tasks to be completed.
3. Executives Confirm Disconnect Among Personnel in
Managing Risk
Survey findings this year again confirm an alarming disconnect
among personnel within an organization when it comes to
risk management. Ongoing two-way engagement between
front-line workers and senior executives regarding risks facing
the company, and an organizational culture that empowers all
personnel to share information and engage across functions,
are essential elements to effectively identifying and mitigating
risk. Without demonstrable leadership by executives that aligns
everyone in the organization, an effective risk management
program cannot materialize and the credibility of executives
is diminished. But this year’s findings indicate executives have
done little to bridge these divides.
Culturally speaking, 83 percent agree it is ultimately the hearts
and minds of their employees that they need to influence to
achieve and sustain good operational performance (that is, to
maximize efficiency and minimize loss). But only 11 percent of
executives believe they do a good job in engaging employees.
Without ongoing direct engagement between executives and
operations staff, small, hidden risks often remain unidentified,
and these small risks can potentially become catastrophic
incidents that threaten the business.
Nevertheless, one quarter of surveyed executives feel strongly
that front-line personnel are not aligned on top risks facing the
organization. And even though only 11% of executives strongly
believe that there is misalignment at the senior leadership level,
they do not believe that there is a complete alignment either. In
fact, more than half (55 percent) of respondents feel that there
is some misalignment of risks at the senior leadership level.
Similar findings were noted in last year’s survey (44 percent),
which is a general indication of a significant engagement gap
between leaders and front-line workers in a company.
MISALIGNMENT WITHIN ROLES
Front Line Operators
25%
Front Line Supervisors
16%
Middle Management
12%
Senior Executives
11%
% of respondents who believe there is misalignment within roles

“ Risk Management works best when
everyone is empowered to speak out
and take action.”
CHIEF EXECUTIVE, HEALTHCARE INDUSTRY
If senior executives and front-line staff have different
perceptions of risk, it means that executives will not have
an adequate understanding of risks that exist on the shop
floor or processing line. Front-line personnel have a keen
understanding of operational risks; better than others
throughout the organization, as they see these risks during
their daily work activities. Two-way engagement between
leaders and front-line personnel will ensure consistent
understanding of top risks across the company and promote
alignment in understanding operational risks, which will
enable the effective prioritization of resources for risk
reduction.
CLOSING THE GAPS: EFFECTIVELY MANAGING
RISK TO IMPROVE BUSINESS CONTINUITY AND
PERFORMANCE
Company executives participating in this year’s DSS global
operations risk management survey have made it clear they
want to reduce risks facing their respective organizations;
where they are falling short is executing the elements
necessary to actually follow through. And yet, the potential
consequences could not be higher. Every company is
just one significant incident away from reputational and
financial loss. BP’s shareholder value plummeted 55 percent
immediately following the Deepwater Horizon incident⁴,
for example. Though this large British multinational
corporation eventually recovered, many other companies
may not be so fortunate after experiencing a similar
incident.
At DSS, we have seen through work with our clients around
the globe that the key to effectively managing risks, across
a client’s value chain, is implementing a holistic operational
risk management (ORM) program that:
• Identifies potential threats and vulnerabilities
• Develops strategies to mitigate risks
• Fully integrates the program across key functions of
the organization to eliminate silos
• Regularly reviews components of the program to
ensure their continued utility and effectiveness.
Doing so leads to more focused, engaged and risk-aware
employees, more reliable assets and more effective systems
and processes. This in turn results in higher productivity and
business performance across the organization.
There are steps executives can take immediately to develop
an integrated risk management plan and translate their
commitment to risk management into an actionable plan.
ASSESS, PRIORITIZE & PROFILE RISK
The first step toward developing a holistic ORM approach
is conducting a comprehensive risk assessment to identify all
possible threats that exist across the entire business value stream
and can impact business continuity and performance.
Once all risks have been identified, they must be prioritized.
Not all risks are created equal. Some risk events are less likely
to occur, but carry with them significant consequences. Other
risks are more likely to occur, but their impacts can be less
severe. Because an organization’s resources are finite, it is
important that companies apply resources, whether financial or
physical, in such a way as to maximize the organization’s overall
risk reduction. This requires developing an operational risk
profile for the company, which prioritizes focus and ownership
of identified risks based on the company’s tolerance for
those risks given its unique business profile (sector, location,
composition, etc.).
“ We have updated our Risk Management
System to increase visibility and to
focus attention on identifying high
risk activities, improved our PSM
governance, have more visible metrics
and increased the sharing of incident
learnings across the globe.”
DIRECTOR , OIL & GAS INDUSTRY
Once an organization’s operational risk profile is established,
a fully integrated approach that links key functions across the
company to a common goal, of driving desired risk reduction
outcomes needs to be developed. Importantly, the ORM
program should always be tied to the goal of improving overall
business performance; that is, mitigating business disruptions
arising from things such as international trade developments,
changing regulations or supply chain disturbances.
4
“BP Lost 55% Shareholder Value After the Deepwater Horizon Incident,” marketrealist.com, September 10,
2014.
REDUCE RISK THROUGH AN INTEGRATED FRAMEWORK THE DSS INTEGRATED FRAMEWORK
Achieving risk reduction outcomes that are tied to business
strategy can be done by implementing an integrated framework
in which four key components – employee mindsets and
E T ENCIES MIND
SET
P
behaviors; organizational governance and management; COM S &
processes and technology; and workers’ capabilities and

S&

BEH
LITIE
competencies – continuously reinforce each other. This

AVIO
Framework is applied across the value chain to best understand

CAPABI

RS
risks that could appear as minor in one area and escalate into
bigger risks further down the value chain. OUTCOMES ACHIEVED
By asking the right questions we’ll help
GOVERNANCE & MANAGING SYSTEMS TO you build an engaged culture and
implement sustainable solutions that

EMEN T
P ROCE
BALANCE SHORT-TERM & LONG-TERM RISK optimize outcomes, reduce risk,
increase efficiencies and create
a competitive advantage.

N AG
S SE
Desired outcomes for the company need to be translated
TEC

S+

MA
into governance and management systems, including key +
NHN E
performance indicators, that are regularly monitored and
OL OG N ANC
reported to executives and the Board of Directors, and the Y GOV ER
organizational structure necessary to keep the company focused
on the outcomes needs to be developed. © 2018 DUPONT.

Fundamentally, Boards of Directors and Executive Committees
should pay as much attention to long-term risks facing their
organizations as they currently do short-term financial impacts.
Concerns with sales, earnings and cash flow, and the lagging
indicators that are indicative of problems that can impact them
are understandably top-of-mind for corporate leaders.
But, as discussed above, there are numerous other risks that
can have tremendous negative impacts, often leading to a
catastrophic incident that impacts the organization’s right to
for injuries, and asset downtime. Most importantly, regularly
evaluating these factors within the context of organizational
vulnerability and addressing them before business disruption
occurs can foster a broad organizational mindset of vigilance
that is not limited to addressing just what is obvious. It will
help balance the focus between short-term and long-term risks
and be a powerful deterrent to complacency.

“
operate, results in employee fatalities, or otherwise threatens a
company’s future performance.
My organization is improving our
strategic planning process and
Take, for example, the cascading consequences that can including risk management in our
result from natural disasters or severe weather events such as strategic topics to be measured and
the impact that 2017’s Hurricane Harvey had on numerous
monitored regularly.”
industries. Flooding from Harvey forced nearly one-fifth of U.S.
oil refining capacity to shut down, which in turn caused the CHIEF TRANSFORMATION OFFICER , UTILITIES INDUSTRY
closure of major pipelines to the Northeast, which in turn led to
an increase in retail gasoline costs of nearly 40 cents per gallon
in that region.5 PROCESSES & TECHNOLOGY TO REDUCE
RISK & INEFFICIENCY
To give due consideration to these other risks, corporate
leaders should endeavor to consider all potential external risks Given the day-to-day pressures associated with running
while accessing and evaluating important leading indicators of a company, it can be easy for leaders to rely on initiatives
business performance to ascertain internal risks. Data indicating and procedures to help manage the risk. All too often, new
organizational vulnerabilities such as supply constraints, high procedures are developed to address issues when they arise and
employee turnover, and increasing use of unsupported or are added to a litany of existing processes without taking a step
obsolete technologies, for example, are just as important as back to consider how the new procedure relates to existing
data showing employee safety performance, work time lost procedures already in place.

5
U.S. Energy Information Administration, September 2017
 Also, adding procedure upon procedure leads to initiative
saturation within an organization, which significantly taxes
available time and motivation of workers. In the area of quality
assurance, this can create a culture in which workers approach
procedures with a ‘check the box’ attitude, which can have
the opposite of the desired effect and actually contribute to
unsafe working conditions as employees stop consciously
looking for or anticipating potential daily risks. Instead,
companies should simplify their processes while being sure
they link to a comprehensive view of the operational risk
facing the organization with the goal of increasing business
performance. Executives should seek input from front-line
workers who experience risks on a daily basis, and make an
effort to demonstrate to every employee their personal, and
therefore the organization’s, strong commitment to risk
awareness and reduction.
CAPABILITIES & COMPETENCIES TO
EFFECTIVELY IMPLEMENT PROCESSES
“
Training, audits, compliance,
process improvement and leadership
development at all levels is required to
improve risk management.”
C-SUITE, FOOD & BEVERAGE INDUSTRY
Ultimately, any safety management system needs to be executed
by people. A well-designed risk management system will not
result in desired outcomes without a workforce that is capable
and has the right mindset and discipline to execute it. When
assessing a risk management system, it is important to realize
that organizational capability and culture play significant roles,
as do the processes for managing their performance.
“ Involve all employees, create
awareness and empower the entire
organization of tools and systems for
proper management.”
DIRECTOR OF RISK , MANUFACTURING INDUSTRY
ALIGNING MINDSETS & BEHAVIORS TO
DRIVE SUSTAINABLE CHANGE
An organization-wide culture needs to be built and nurtured
that aligns the Mindsets & Behaviors of all employees toward
achieving the desired outcomes, and this must be done with the
active participation of company executives.
Leveraging the day-to-day operational knowledge of front
line personnel on the shop floor or in the field is a key success
factor in any cultural transformation. While these workers may
be generally aware of existing operational risks, over time they
can become desensitized to them. The re-internalization of
these risks by operating personnel is important and can only be
achieved effectively through broad and continuous engagement.
Organizations should recognize that these personnel are a
critical layer of protection within their operations. These
workers are most familiar with the organization’s activities,
equipment and processes, and therefore the risks. They should
be appropriately engaged, empowered, and supported.
“ We are engaging our workforce to
understand and mitigate risks.”
CHIEF OPERATIONS OFFICER , OIL & GAS INDUSTRY
Finally, it is important that leaders be “affective” in their
approach to risk management. In other words, the actions and
consistent messaging of an organization’s management should
be genuine and heartfelt when interacting with employees.
Company executives should seek to foster a trusting work
environment, and their leadership style should demonstrate
humility and partnership with employees. They should
encourage bottom-up engagement with employees, not top-
down edicts from the C-suite.
“ We are focusing on Behaviors and
the difference between individual
employee and Management
behaviors.”
DIRECTOR , CHEMICAL/PETROCHEMICAL INDUSTRY
By being conscious of long-term risks; not constantly layering
new procedure upon old and creating a complex patchwork
of processes to address problems when they arise; and
implementing a holistic operational risk management program,
company executives will be able to transcend a mere focus
on employee safety, to mitigate the many additional risks
that threaten business continuity and performance. They will
eliminate silos that prevent them from minimizing or even
eliminating risks before they manifest into costly incidents. They
will enhance their ability to build resilience in the organization.
And they will improve their decision-making process to make
the right decisions at the right time to extract the most value out
of the business.
 ABOUT THE SURVEY – AT A GLANCE

Executives from more than 350 companies around the globe participated in the survey.

One-half of survey participants (52 percent) were senior executives (CEO, CFO, etc.) and one-half (48 percent) were at
the Executive Director level.

Companies participating in the survey represented a wide range of industry sectors:

– Sixty percent represent high-hazard industries including mining & metals, oil & gas, and manufacturing.
– Forty percent represent industries impacting the general public including transportation, utilities, food & beverage,
and healthcare.
– About 38 percent can be characterized as having complex value chains including chemicals & petrochemicals, food
& beverage, and manufacturing.

In terms of geographic location, 44 percent of survey participants were from companies located in North America,
24 percent were in Europe, and 27 percent were in Asia-Pacific.

Roughly two-thirds of companies represented in the survey have a global presence, and the remaining companies
have only a regional presence.

Nearly half (46 percent) of companies represented in the survey have a workforce composed of more than 20
percent contractors.

Nicholas Bahr is the Global Practice Leader for Operational Risk Management, DSS. nicholas.bahr@dupont.com
Alfonsius Ariawan is Global Implementation Architect, DSS. alfonsius.b.ariawan@dupont.com

DuPont Sustainable Solutions, a business unit of DowDuPont Specialty Products division, is a leading provider of world-class operations
consulting services to help organizations transform and optimize their processes, technologies, and capabilities. DuPont Sustainable
Solutions is committed to improving the safety, productivity, and sustainability of organizations around the world. Additional
information is available at www.sustainablesolutions.dupont.com

DowDuPont Specialty Products, a division of DowDuPont (NYSE: DWDP), is a global innovation leader with technology-based materials,
ingredients and solutions that help transform industries and everyday life. Our employees apply diverse science and expertise to help
customers advance their best ideas and deliver essential innovations in key markets including electronics, transportation, building and
construction, health and wellness, food and worker safety. DowDuPont intends to separate the Specialty Products Division, which will
be called DuPont, into an independent, publicly traded company. More information can be found at www.dow-dupont.com

Please join us in discussing these and other industry-related topics on LinkedIn.

linkedin.com/company/dupont- twitter.com/DuPont_DSS | www.youtube.com/

sustainable-solutions/ @DuPont_DSS DuPontSustainableSol

www.sustainablesolutions.dupont.com
Copyright ©2018 DuPont. All rights reserved. The DuPont Oval Logo, DuPont™, and all products denoted with ® or ™ are trademarks or registered trademarks of E. I. du Pont de Nemours and
Company or its affiliates.