Ten years ago a large multinational consumer products organization left itself too exposed to risky events that negatively impacted its production — and its brand. Determined never to leave itself unprotected again, the organization implemented a comprehensive cross-enterprise risk management program designed to anchor it against whatever hurricane-force winds may prevail.

The organization mandated that every facet of the business drop the same size anchor — in the form of internal controls and compliance checklists — regardless of the size of business unit or location.

Anyone found not using the anchor was thrown overboard.

As the years passed and the company grew, the organization’s static approach to risk management and controls — its anchor against rough market seas — began to weigh it down. Many of those tasked with implementing the program had no idea why they were doing it. And the controls and compliance checklists they were mandated to implement were far too expansive for the risk they were designed to protect against. Moreover, because the organization had not reviewed its risk management program in the years since its implementation, it had no visibility into whether the risks that the program was designed to protect were the risks that mattered most. And it had no idea how much its bloated risk and controls program was costing.

The very risk management program the organization had designed to protect itself was paralyzing decision-making and causing it to lag behind its competition. The huge anchor was dragging it under water.

Insights for executives5

Don’t let risk weigh you downTake a more nimble approach to create value and improve performance

Consumer products

Of special interest to Consumer products executives

What’s the issue?Multiple regulatory requirements from food safety to the Foreign Corrupt Practices Act, as well as various customs and trade requirements, provide greater complexity to consumer products organizations.

To address this complexity, many organizations take a static approach to risk management and controls in their operations and finance areas, costing more than necessary, compromising business performance and limiting profitable growth.

This approach can slow an organization’s ability to keep pace with accelerating change, its growth trajectory and its flexibility to proactively prepare for unforeseen events.

A one-size-fits-all approach to risk management and controls costs more than it has to, compromises business performance and limits profitable growth.

2 | 5 Insights for executives [Consumer products]

Why now?The consumer products industry is more competitive than ever. A rising number of global competitors, the constant quest for the next “big hit” and escalating raw materials costs are squeezing already tight margins. In developed markets, consumer products organizations are fighting both flat or declining demand and pressure from private labels and other new players that are disrupting traditional market dynamics. As a result, these organizations are racing to gain an edge in emerging markets where they face fierce competition from their developed market peers and emerging market domestic players that already have brand recognition.

To remain competitive, consumer products organizations need to have the flexibility to increase speed to market, minimize administrative and operational burdens, protect itself from emerging and unforeseen risks, and deliver sustainable cost savings.

How does it affect you?Overengineered risk management and controls programs tend to be a sign that an organization lacks confidence in its ability to adequately protect and monitor itself. This leads to a number of unintended consequences that have the potential to be more damaging than the risks the program was initially designed to protect.

For example, programs with multiple siloed risk functions can end up with overlaps and gaps in risk coverage, creating a risk environment that is either overcontrolled or undercontrolled. A lack of transparency across risk functions also means that the organization has little visibility to which risks matter most relative to its risk appetite, how much internal controls are costing or how many resources are dedicated to managing a manual control environment.

Additionally, business units in emerging markets that are mandated to use controls meant to address risks in developed markets are devoting valuable resources to implementing controls that may have little or no relevance. At the same time, they may be ignoring controls that could protect the business unit from the emerging market risks they actually face.

These inefficiencies eat into already tight margins and significantly reduce a consumer products organization’s ability to respond to a rapidly changing landscape — ultimately compromising its ability to grow in both established and emerging markets.

35 Insights for executives [Consumer products] |

What’s the fix?To compete in today’s fast-moving environment and protect the business, consumer products organizations need a dynamic risk management program that can be tailored to the needs not only of the organization, but also of each business unit. This requires a multifaceted approach:

1. Identify the risks that matter most. Risk is inherent in every business, but consumer products organizations that embed risk management practices into business planning and performance management are more likely to achieve strategic and operational objectives. To be successful, organizations need to define the risks that drive growth and create value and then differentially invest in the risks that matter most to enable performance. Consumer products organizations also want to identify and manage emerging risks that may impact their business models and growth trajectory.

2. Enable smart controls to optimize the control environment. Our experience suggests that a range of 20% to 40% of process cost relates to controlling activities. Despite this spend, many control environments are not responsive to risks that matter most to an organization. Moreover, many organizations have been reluctant to consider opportunities that remove excessive costs from controls. The prevailing fear is that streamlining and automating controls could reduce quality and expose the organization to risk. Smart controls — a single, global, streamlined set of controls aligned to the risks that matter that use technology and continuous monitoring capabilities — enables organizations to rebalance controls cost, enable growth and keep the business safe.

3. Use governance, risk and compliance (GRC) technology to enable risk and control alignment. Many organizations have invested in GRC technologies to address specific risk, control and regulatory requirements. In fact, some organizations have invested in multiple GRC technologies to address requirements from siloed risk functions and multiple regulatory requirements. Leading companies are now driving alignment across risk functions and regulatory requirements by using GRC technology as an enabler to strengthen risk processes and to establish a common risk platform, establish an organization relevant to risk appetite, enable smart controls, automate manual processes and generate real time reporting.

4 | 5 Insights for executives [Consumer products]

3 Use GRC technology to integrate and automate smart controls

2 Enable smart controls using a “zero-based” controls framework

Develop strategy Design and build Run and operate

1 4 Identify the opportunity — know the risks that matter

Embed low-cost, effective sustainable operating model

• Create clarity, alignment and commitment in the business

• Understand the current state of the control environment including the proficiency of risk management functions

• Understand control cost drivers and compare to benchmarks

• Align business case to overall enterprise strategy

• Create a business case and execution plan

• Design a zero-based controls framework aligned to process objectives

• Evaluate technology enablers and integrate into existing technology infrastructure

• Create a functional operating model

• Execute new control capabilities applying a cost-effective operating model

• Document revised control model • Execute, monitor and remediate

new controls • Measure return on investment

Zero-based controls framework − a single, global, streamlined set of controls aligned to risks that matter, leveraging technology and implementing continuous monitoring capabilities

55 Insights for executives [Consumer products] |

What’s the bottom line?Until recently, consumer products organizations were focused on mitigating risks, controlling costs, keeping the business out of trouble and protecting the brand.

That focus has shifted. Today, organizations are more interested in developing risk management strategies that enable the business, accelerate performance and drive growth.

Consumer products organizations that embed automated smart controls and GRC technology into their risk management programs will see significant efficiency improvements almost immediately, including:

• Greater visibility into the risks that matter most based on risk tolerance

• Risk alignment to corporate strategy

• Potential 20% to 40% reduction in process costs related to controls

• Increased reliance on automated controls enabled by GRC technology

• Real-time monitoring and reporting

• Increased business performance and significant return on investment

6 | 5 Insights for executives [Consumer products]

Want to learn more?

For related thought leadership, visit www.ey.com/consumer products

The answers in this issue are supplied by:

Gregg ClarkAmericas Advisory Consumer Products and Retail LeaderErnst & Young LLP+1 860 725 3815gregg.clark@ey.com

Robert CullenAmericas Advisory Internal Controls LeaderErnst & Young LLP+1 612 371 6709 robert.cullen@ey.com

Matthew PolakAmericas Advisory GRC LeaderErnst & Young LLP+1 412 644 0407matthew.polak@ey.com

Today, organizations are more interested in developing risk management strategies that enable the business rather than just keeping it out of trouble.

75 Insights for executives [Consumer products] |

We want to hear from you!Please let us know if there are subjects you would like 5: insights for executives to cover.

You can contact us at: fiveseries.team@ey.com

EY | Assurance | Tax | Transactions | Advisory

Let’s talk: protecting performanceSafeguarding reputation and business performance is a top priority for organizations today. Rising commodity prices are leading to greater competition for available resources and placing an ever-tightening squeeze on margins. Intense emerging market competition is forcing companies to manage internal and external access to critical information. Industry consolidation, aging assets, complex global supply chains and tighter regulatory scrutiny add to the complexity of today’s business environment. In an era bursting with opportunities and unbounded vulnerability, organizations have to rethink how they can simultaneously protect the business and accelerate performance.

Breaking down silos, identifying the risks that matter most, automating internal controls, and using advanced data analytics and GRC technology give organizations the ability to do more than protect themselves from the worst. These steps also give organizations the agility to seize the opportunities that create lasting value across the enterprise.

Learn more at www.ey.com/protect

About EYEY is a global leader in assurance, tax, transaction and advisory services. The insights and quality services we deliver help build trust and confidence in the capital markets and in economies the world over. We develop outstanding leaders who team to deliver on our promises to all of our stakeholders. In so doing, we play a critical role in building a better working world for our people, for our clients and for our communities.

EY refers to the global organization, and may refer to one or more, of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients. For more information about our organization, please visit ey.com.

Ernst & Young LLP is a client-serving member firm of Ernst & Young Global Limited operating in the US.

About EY’s Advisory Services Improving business performance while managing risk is an increasingly complex business challenge. Whether your focus is on broad business transformation or more specifically on achieving growth, optimizing or protecting your business having the right advisors on your side can make all the difference. Our 30,000 advisory professionals form one of the broadest global advisory networks of any professional organization, delivering seasoned multidisciplinary teams that work with our clients to deliver a powerful and exceptional client service. We use proven, integrated methodologies to help you solve your most challenging business problems, deliver a strong performance in complex market conditions and build sustainable stakeholder confidence for the longer term. We understand that you need services that are adapted to your industry issues, so we bring our broad sector experience and deep subject matter knowledge to bear in a proactive and objective way. Above all, we are committed to measuring the gains and identifying where your strategy and change initiatives are delivering the value your business needs.

© 2013 Ernst & Young LLP. All Rights Reserved.

SCORE No. BT0326ED None

This material has been prepared for general informational purposes only and is not intended to be relied upon as accounting, tax, or other professional advice. Please refer to your advisors for specific advice.

ey.com/5