3M’s John Ostergren on supply chain, third-party risk management

The idea of knowing and wantonly taking chances would seem to run counter to most corporate cultures. For most businesses, however, doing nothing is the biggest risk of all.

That is the message from John Ostergren, director of environment, health and safety at 3M. It is important to take a longer-term view of risk, he says.

We chatted with Ostergren about risk management, corporate and shareholder debates over “long-termism” and short-termism” and taking a quarter century view when it comes to assessing the value of an investment, not just results over a financial quarter.

3M is a global science company with $30 billion in sales, and 90,000 global employees.

CW: Can you tell us about yourself? What path led to your career specialty at 3M?

JO: I’m a lawyer by training and a scientist at heart. I did my Ph.D in environmental geochemistry before I went to law school.

That’s the foundation that helps me connect with a science-based company, and that connection is pervasive for anything I’m doing here, more so than just wearing a legal hat.

I was most recently leading our supply chain legal team and now I lead our EHS (environment, health and safety,) team. As you can probably appreciate; there is a lot of natural synergy between the legal and the EHS functions, particularly in the area of holistic risk management.

If I wind my career clock back to the beginning, I was originally an environmental scientist. One of the things I quickly learned is that, typically, you can’t be an environmental scientist without the experience of something becoming a so-called legal issue at some point if it is of any significance.

Prioritization is essential for risk management and it is essential for virtually everything we do at 3M. It is one of the fundamental leadership behaviors we identify at the company.




,

So, I became a lawyer, came to 3M as a lawyer, and am now having the chance to go back to my first passion, environmental sciences.

CW: How helpful is it to have scientific background as well as legal expertise?

JO: It is essential. That is the word I would use, recognizing, of course, that I work with a lot of people at 3M who have scientific bona fides with less formal training. You cannot work at 3M without being grounded in scientific ideas and disciplines, and be ready willing and able to engage in discussions with highly trained specialists. Science applied to life is a very real thing at 3M, and it starts with our scientists, who do some of the most important and interesting things that fuel the rest of the company. Being able to, literally, speak the same language has been essential for me and it is what makes my job fun.

CW: Over the years, disclosures of risk factors at public companies keep growing and multiplying. How can a company prioritize the risks that truly need attention in an age where nearly anything can be counted as a risk factor? How can a company prioritize the risks that really need attention?

JO: Prioritization is essential for risk management and it is essential for virtually everything we do at 3M. It is one of the fundamental leadership behaviors we identify at the company. We all need to demonstrate it in any of the topic areas or silos we are working. The litmus test for effective prioritization is effective execution.

Find ways for your risks to be your opportunities. Make risk management another way to think about good management, and vice versa. Management discussions and decisions that are disconnected from risk management can be dangerous.

From my perspective, one of the most important things about prioritizing for risk management is that we recognize that its not just defense. Risk management is about, in frequent cases, risk optimization. You can manage yourself to zero risk by certain behaviors that would be commercial suicide. Knowing the difference between good risk and bad risk is critical, and that is one of the primary criteria for prioritization.

The core is making sure we have compliance nailed down for zero tolerance, must-do activities. There are certain areas where we have to get it right and compliance is one of those.

Beyond that core, we are most often talking about risk where optimization is essential and trade-offs need to be done in an orderly manner. I tend to think of that in my world as the distinction between effective risk management and overall good management. It is a distinction that is subtle at best and they are nearly identical. That is especially the case when you recognize risk management from an optimization standpoint.

We have to, with equal vigor, find those risks we are interested in taking in order to do things differently and pursue opportunities that will, with the first step, be a risk. You could be thinking of doing something differently than you have in the past as defensive risk management, but you also can, and must, also think of it as risk optimization and the pursuit of growth.

Putting risk management together with good management comes back to prioritization. To be tautological about it, you have to prioritize. You cannot do everything.

You need to fundamentally understand your business and customers. You need to understand what market you are working in, your supply chain, and what your customers are demanding in order to optimize the value stream and balance those zero-tolerance compliance components with the optimization of risk management components for commercial success.

CW: The idea of wantonly taking chances would seem to run counter to most corporate cultures. For most businesses, however, doing nothing is the biggest risk of all, you say. Can you explain and defend that viewpoint?

JO: It is about continual, creative destruction. There needs to be a very serious commitment to continuous improvement that includes fundamentally doing things differently. Not just incremental improvements on what you did yesterday, but with real rigor making a programmatic commitment to ensuring we are taking a hard look at what things we should be doing differently to succeed tomorrow.

Yes, almost by definition, when you frame the question that way there is risk. All you know is that things are going to be different from what you did yesterday. There will be some uncertainty and that uncertainty is the source of risk. There is a chance it will go well. There is a chance it will not go well. You need to be realistic about what your odds of success are and, most importantly, map out the risk profile to, obviously, improve your changes of success and choose your targets well.

It is all on a foundation of needing to do things differently. If you don’t do things differently, all you are going to get is the same result. That might work for a little while, but it isn’t going to work in the long term.

CW: How does this approach to risk fit within the debates between corporate short-termism and long-termism? You advocate a longer-term view of risk and the potential it offers for business growth. You say that can include a quarter century view when it comes to assessing the value of an investment, not a just financial quarter. Can you discuss that philosophy at 3M?

JO: When companies do well, as this one has for more than 115 years, you have both the privilege and the urgency to consider both short-term and long-term objectives.

There is a chicken or the egg question. You might not be around for 100 years, but you will increase your odds for being around by thinking long-term out of the gate. The fact of the matter, however, is that a start-up company does not have the latitude that we have, or the same urgency around balancing those often-competing perspectives. We, no question, have both.

We have to meet both financial quarter expectations and maintain a rigorous focus on the much longer term in order to do our strategic planning and look around corners that we otherwise wouldn’t even see coming.

We talk sometimes about the microscope and the telescope and taking both of those views. You absolutely need to understand the landscape right under your feet in gory detail. You really do need to see that most distant horizon as best you can to understand what the ground is going to look like tomorrow, because all you know is that it is going to be different than it is today. The better you can predict that future, the better you will be positioned for success in it.

CW: How do third parties complicate risk mitigation? How to you make sure third parties and vendors embrace the same values as 3M?

JO: There are very tactical aspects for how we do that through vetting business partners in various ways, whether it is suppliers or other service providers.

More broadly than those tactical pieces, we need to look at our third-party partners as part of our solution, not our problem. Yes, they do complicate things, but done well it delivers more value to the end customers than we would absent the collaboration. That is how we look at it. Those third parties have to be accretive to value in the whole. We have to create situations where the reason we are not doing all of this ourselves is because we do it better together.

We need to recognize that we are not working with third parties to offload the stuff that we don’t want to do or we don’t know. We are offloading, so to speak, and partnering with those third parties so we can be greater than the linear sum of our parts.

Part it is risk management. We have to understand how they manage their risks because in value streams their risks become our risks. We need to understand that and find ways to manage it.

That’s not to say we take managerial control of our third parties’ operations, but we do have a need to understand how they are managing the risks that will become our risks.

CW: What advice might you have for those who, like you, are in the role of evaluating supply chain risk?

Find ways for your risks to be your opportunities. Make risk management another way to think about good management, and vice versa. Management discussions and decisions that are disconnected from risk management can be dangerous.