• Risk treatment: considers whether additional controls (e.g., critical controls) and action plans are needed to further mitigate risks outside the tolerability level • Recording and reporting: records risk assessment outcomes in our Integrated Management System (IMS) and establishes reporting requirements • Communication and consultation: validates new risk assessments, treatment plans and updates, and ensures significant risks are validated and communicated to senior leadership • Monitoring and review: ensures that risk owners review all risk information about their assigned risks, management reviews relevant risk treatment action plans, and leadership reviews the effectiveness of the risk management processes at least annually, with an internal cross-functional disclosure committee meeting quarterly and designated top risks reviewed at least semi-annually COUNTRY RISK PROGRAM Our Country Risk Program is an important component of our risk management approach.