Question: identify which activities correspond to each framework. focus on Traditional ERM (primarily COSO) vs. Value-Based ERM

Risk Governance The head of the ERM program is the General Counsel, who also has responsibility for compliance. The Risk Council, comprised of 7 members of senior management, provides guidance on the ERM program. Figure 1: KHC's Governance Framework Risk Governance Framework Heinz Reputation (CEO, Officers, BU Presidents, and Board of Directors) Management Leadership Risk Areas Corporate Governance And Ethics (Vice President) Strategic (Office of the Chairman) Market (Office of the Chairman) Operational (Supply Chain) Risk Areas Asset Business Environmental & Conservation Health & Safety (Director ORM) Security (Director ORM) Continuity Operations (Director ORM) Quality (Vice President) Sustainability (Director ORM) (VP Insurance/ Director ORM) Foundation Functional Risk Areas Financial, Including SOx (Chief Financial Officer) Human Resources Legal (General Counsel) Information Services (Chief Information Officer) (Chief People Officer) ERM Framework Figure 2 is a visual representation of KHC's ERM framework. The following is an overview of the main process steps: Figure 2": KHC's ERM Framework Identify Risks Accept Qualitative Scoring Mitigate Manage Organize Avoid ransfer/ Assign Report Saft foods 1) Identifying risks: Approximately 250 senior management personnel across KHC are surveyed using SurveyMonkey annually to gather information on both internal and external risk factors, spanning risks from all areas such as financial, operational, legal & regulatory, reputational, human capital, and disasters Risk data and control activities are captured in the survey. This information includes: risk descriptions, functional risk area and ownership, risk classification, control policies, control procedures/processes, scorecards/measurements, and risk monitoring procedures. Risks are then consolidated and discussed by the Risk Council, at an offsite all-day meeting, at the conclusion of which the Risk Council conducts a qualitative scoring. Qualitative scoring (each criterion is based on a five-point scale)v: 2) Likelihood Impact Control Effectiveness Level Risk Governance The head of the ERM program is the General Counsel, who also has responsibility for compliance. The Risk Council, comprised of 7 members of senior management, provides guidance on the ERM program. Figure 1: KHC's Governance Framework Risk Governance Framework Heinz Reputation (CEO, Officers, BU Presidents, and Board of Directors) Management Leadership Risk Areas Corporate Governance And Ethics (Vice President) Strategic (Office of the Chairman) Market (Office of the Chairman) Operational (Supply Chain) Risk Areas Asset Business Environmental & Conservation Health & Safety (Director ORM) Security (Director ORM) Continuity Operations (Director ORM) Quality (Vice President) Sustainability (Director ORM) (VP Insurance/ Director ORM) Foundation Functional Risk Areas Financial, Including SOx (Chief Financial Officer) Human Resources Legal (General Counsel) Information Services (Chief Information Officer) (Chief People Officer) ERM Framework Figure 2 is a visual representation of KHC's ERM framework. The following is an overview of the main process steps: Figure 2": KHC's ERM Framework Identify Risks Accept Qualitative Scoring Mitigate Manage Organize Avoid ransfer/ Assign Report Saft foods 1) Identifying risks: Approximately 250 senior management personnel across KHC are surveyed using SurveyMonkey annually to gather information on both internal and external risk factors, spanning risks from all areas such as financial, operational, legal & regulatory, reputational, human capital, and disasters Risk data and control activities are captured in the survey. This information includes: risk descriptions, functional risk area and ownership, risk classification, control policies, control procedures/processes, scorecards/measurements, and risk monitoring procedures. Risks are then consolidated and discussed by the Risk Council, at an offsite all-day meeting, at the conclusion of which the Risk Council conducts a qualitative scoring. Qualitative scoring (each criterion is based on a five-point scale)v: 2) Likelihood Impact Control Effectiveness Level