Operational risks can often be influenced, which is why they are normally regulated by policies, guidelines and instructions. Operational risks are part of Cloetta’s day-to-day work and are managed by the operating units. Operational risks include those related to the brand, relocation of production, insurable risks and environmental, health and safety-related risks and IT-related risks.
| Risks PROBABILITY |
Management IMPACT |
|
| Business ethics and brand risks | Demand for Cloetta’s well-known brands is driven by consumers’ association of these brands with positive values. If Cloetta or any of the Group’s partners takes any measures that conflict with the values represented by the brands, the Cloetta brands could be damaged. |
Cloetta takes a proactive approach by adhering to a Code of Conduct |
| Social conditions in the supply chain |
Cloetta uses some raw materials that originate from regions or countries with an increased risk of human rights violations and corrupt behaviour. Further, political instability in places where raw materials are produced can have a negative impact on availability and costs. |
Cloetta’s Supplier Code of Conduct is part of all supplier agreements. Cloetta assesses the raw materials and prioritises involvement with suppliers and organisations for certain materials based on climate, social and human-rights related risks. 100% of all cocoa purchased is UTZ/Rainforest Alliance certified. 100% of all palm oil used in Cloetta branded products is RSPO Certified Segregated palm oil which is one of the highest standards to ensure deforestation free and sustainably farmed palm oil. Certification of Cloetta’s factories according to this standard has been upheld since 2019. Since 2017 Cloetta has purchased sustainable and traceable shea butter from women cooperatives in Africa. Cloetta participated in a pilot initiative with Rainforest Alliance to |
| Environmental and climate related risks |
There is a risk that climate change will impact Cloetta. This may involve transition risks such as changing rules and taxation, as well as physical risks. Physical risks include changes that are both long-term and urgent in nature, for example extreme weather conditions and natural catastrophes that could impact Cloetta’s access to raw materials and disrupt business operations directly or indirectly. |
Cloetta is raising the ambition level to improve its total environmental 100% of all cocoa purchased is Rainforest Alliance certified. |
| Product safety risks | Handling of food products places high demands on traceability, hygiene and safety. In a worst-case scenario, inadequate control can lead to contamination or allergic reactions. These types of deficiencies in the handling of food products can lead to lower trust in Cloetta and the Group’s brands. | Cloetta works with first-class raw materials and in accordance with international quality standards. Analyses through chemical and physical tests are performed on both raw materials and finished products. Issues of importance for product safety are collated in special policies. Plans for information or product recalls in the event of deficiencies have been prepared. |
| Insurable risks | Assets such as factories and production equipment can be seriously damaged, for example in the event of a fire or power outage. Product recalls can incur substantial costs, resulting in direct costs, claims for financial compensation and damage to Cloetta’s reputation. Cargo may be damaged in transit. | Cloetta has an insurance programme for property and liability risks appropriate to Cloetta’s operations, and works systematically to limit the risk of incidents and to have robust contingency plans in place to limit the effects of any incidents. |
| Disruption and relocation of product manufacturing | Disturbances and inefficiencies in the supply chain, as well as undesirable effects on and from the external environment, such as a fire, strikes, pandemics or extreme weather, could result in stoppages in production, operations and deliveries, and thus negatively affect the company’s business and reputation. To optimise efficiency, Cloetta continuously monitors capacity utilisation in manufacturing and evaluates the need to move manufacturing from one factory to another. This is however a complex process that can result in disruptions and delays in production, which can in turn also lead to delivery problems. | Cloetta has a good monitoring process in place to anticipate short term disruption both in sourcing and delivery. In our factories we have clear protective protocols in place to reduce the risk, provide a safe workplace and limit the impact. Cloetta also has an experienced and efficient organisation with well-established routines for handling. |
| Access to the right expertise |
To a large extent, Cloetta’s future is dependent on its capacity to recruit, retain and develop competent senior executives and other key staff. Cloetta occasionally reorganises and streamlines its operations, which in the short term may have a negative impact on its performance. |
Cloetta endeavours to continue to be an attractive employer. Employee development and follow-up plans, together with market-based and competitive compensation, enable Cloetta to recruit and retain employees. Cloetta has a strong and experienced organisation that is well equipped to handle organisational changes. |
| IT Security | Cloetta is highly dependent on having an efficient IT platform. Disruptions or faults in critical systems can have a direct impact on both production, financial systems, and business processes. Over the years, efforts have been made to harmonise and standardise the IT landscape by minimising the number of supported IT applications and continuously invest in IT infrastructure. Examples of risk mitigation in infrastructure is redundant network access, mirrored and physically separated environments for critical business applications. The IT security is the defense to protect against potential loss or harm related to technical infrastructure, use of technology or reputation of our organisation. |
Cloetta operates under a centrally controlled IT governance and continuously mitigates against all dimensions of attacks by assessing its cyber risk profile, remediating where recommended and pro-actively managing and investing in its defences. End-users are frequently trained in information security to further increase the awareness. |