2021 Owens Corning Sustainability Report | Our Approach | Risk Management | 59 Risk Registers Owens Corning’s business units proactively analyze risks and create business- and function-specific risk registers. We currently have an enterprise risk register and sub-registers for each of our three businesses, as well as compliance and finance. The risk committee uses these individual risk registers to create an enterprise risk register, which enables business units and the risk committee to facilitate strategic and operational planning processes while mitigating sustainability and other risks. Risks are prioritized based on their placement in the risk register. The Y-axis (“Value”) represents the potential financial impact, while the X-axis (“Likelihood”) represents the probability of occurrence. Color coding (for risk acceptability) and different shapes (for trending information) offer a fuller understanding of the potential risks. In 2021, we added the concept of risk velocity to our conceptualization of risk, describing the potential rate at which a risk could impact our businesses. While risk velocity is not depicted on the risk register in an infographic manner, the concept is described in conjunction with the overall register narrative. By incorporating the idea of risk velocity into our understanding of risk, we gain a better understanding impending impacts, which enables us to be proactive in our approach. To identify new risks — and update risks no longer considered important — the risk committee conducts quarterly reviews of results and outputs of risk assessments. The risk committee’s quarterly meetings enable them to review and report on robust mitigation plans across businesses as well as corporate functions. Our ERM process is also reviewed quarterly by the audit committee of the board to ensure it remains relevant and proactive. Risk on a Page Owens Corning encourages active learning through risk mapping, and in 2020 we implemented a new tool called Risk on a Page. The new model requires each risk to be presented separately, with dedicated team members playing an active role in managing each individual risk. The tool is used to describe key information about the risk such as risk trend, risk velocity, mitigating actions, and its link to strategic plan. It also includes a map of the risk that depicts its status, from Inherent Risk to Residual Risk, to pictorially represent the impact of mitigating actions, as well as the final mitigated position of the risk for the sub-register or enterprise register. Each risk has two sponsors, one from the risk committee and one from the executive committee, and each risk has its own risk owner and subject matter expert. The subject matter expert and risk owner are responsible for ensuring we have mitigating actions in place for each risk, and that there is consistent progress being made toward mitigation. Risk owners are responsible for the overall management of the risk and communicating cross- functionally and vertically through the organization, ensuring visibility of the risk in all elements of strategic planning. This approach enables us to drive updates to the risk register, as sub-register risks roll up to the enterprise level. The implementation of the tool required extra training in 2020, which will be refreshed for new stakeholders each year. VALUE IMPACT HIGH MEDIUM LOW LOW MEDIUM HIGH T A B M G U R P N I H K J O L E C S Q F LIKELIHOOD TREND ▲ Improving ● Stable ▼ Worsening RISK ACCEPTABILITY (after the impact of existing actions) ■ Risk level acceptable ■ Execution of management plan ■ Management of risk needs improvement No Change New Risk Change LEGEND Example of a risk register for demonstration purposes.