Guest: Rick McDonald, SVP & Chief Supply Chain Officer, The Clorox Company; advisor to supply chain and AI startups including ketteQ, PopCapacity, and Veren AI
Listen on Spotify | Listen on Apple Podcasts | Listen on Amazon Music
In August 2023, Clorox lost its systems to a cyberattack and didn't get them back for months. Rick McDonald, the company's SVP and Chief Supply Chain Officer at the time, made two calls almost immediately: keep every plant running with no visibility into inventory, and ask the supplier base to hold on payments with no firm date for when the checks would come. Both bets paid off. "We were a hundred days in without making a payment" on some accounts, he tells Spencer, and the relationships held anyway. "That's when you learn about how important your relationships are, how important the way you treated your suppliers over time. They stuck right with us."
McDonald spent nearly 33 years moving through supply chain, first ten years running salty snack plants at Frito-Lay, then almost as many at Clorox, where he eventually oversaw $4 billion in spend under management and a global organization of 6,000 to 9,000 people through COVID, the inflation spike that followed it, and the cyberattack that came after that. He retired from the role in 2024 and now advises founders building the next generation of supply chain software. In this episode, he and Spencer trace that arc: the plant floor instincts that shaped his leadership style, the war room decisions that kept Clorox's factories running on paper, and the uncomfortable truth about why companies say they want sustainable sourcing but almost never pay for it.
Why Thirty-Three Years Was Enough
McDonald had a number in mind before he ever took the Chief Supply Chain Officer job: four years, minimum. He ended up going a bit longer, but as the company moved through an SAP transition and a new operating model, he felt the moment arrive. "I just thought it was probably time for somebody else to give it a run and put their energy and their passion, their expertise against it." He also had itches he couldn't scratch inside a 24/7, 365 executive role: more keynotes, more panels, more mentoring than the job ever left room for. Stepping away didn't mean stepping down in intensity. It meant redirecting it.
From the Plant Floor to $4 Billion in Spend
McDonald never planned on supply chain. Out of Georgia Tech, he took the best offer he could find, which was unpaid work at a metal fabricating plant, because he liked the immediate feedback loop of watching output move. That instinct carried him through five different Frito-Lay manufacturing plants over ten years, an incubator, in his telling, for supervisory and leadership skills.
Clorox recruited him repeatedly before he picked up the phone. At the time it was a $1.7 billion, US-only, family-run company hiring manufacturing sophistication from the outside, the way it pulled marketing talent from Procter & Gamble. McDonald ran an LA plant for five years, then took his first procurement assignment: sourcing for Kingsford Charcoal, then a $400 million business with $70 to $80 million in spend under management. It was early days for strategic sourcing, and McDonald volunteered for one of three internal pilots, a modest $13 million spend that returned $4 million in savings by sourcing new raw materials, materials that eventually let Clorox put a new claim on the bag: charcoal briquettes made with supersaturated sawdust, engineered for better-smelling smoke. The idea itself had failed once before, five or ten years earlier, because nobody had figured out how to get the sawdust to absorb properly. A new engineer solved that problem, and a shelved idea became a product claim.
August 2023: The Systems Went Dark
By the time the cyberattack hit, McDonald's remit covered the full breadth of Clorox's supply chain and procurement organization. The shock of losing systems access gave way almost immediately to a structural problem: Clorox had just shifted manufacturing and planning responsibility out to general managers under a new operating model, and most GMs hadn't grown up as supply chain people. "We agreed that we would revert all those responsibilities and capabilities back to me and my team for all decision-making. We needed one place to make decisions, not twelve."
There was an early push to shut the factories down entirely, since nobody had systems to run them properly. McDonald overruled it. "I said, absolutely not. We're going to run our plants. We're going to maintain inventory manually, and because as soon as we are able to ship product, there's going to be some latency to the demand, and we're going to wish we'd run as hard as we could during that time period." Plants kept building. When they needed outside warehousing to hold the inventory, they went and found it. The bet was that the demand hadn't disappeared, only the ability to fill it, and when systems came back, every case they'd built in the dark would matter.
A Hundred Days Without a Payment
The supplier conversations were the part McDonald expected to be hardest, and they turned out to be the smoothest. Procurement handled most of it directly, and at one point McDonald sent a personal letter to Clorox's strategic suppliers laying out what the company knew, which wasn't everything, and asking them to hold on and trust the relationship. They did. "You know, some of our suppliers were absolutely cash businesses," he says, pointing to the wood scrap and sawdust suppliers behind Kingsford charcoal, businesses that couldn't afford to deliver for free and would have had to sell elsewhere. Clorox found ways, with limited resources, to keep cutting checks to that group. Everyone else was asked to hold, and mostly did, for a stretch that ran up to a hundred days on some accounts. Retail customers showed up the same way, with Walmart, Target, Costco, Kroger, and Publix all asking daily and weekly what they could do to help move product as it became available again. "There was just a lot of grace given, on both sides of the table. I take it back to this relationship we built over time, the trust we had in each other."
Business Continuity Plans Only Prove Themselves Under Pressure
McDonald's team had written business continuity plans and even practiced parts of them before the attack. What nobody plans for, he says, is activating every single one at once, for months instead of hours. "Nobody contemplates having to activate all of their BCPs at the same time, and that's essentially what we did. Most of us think, well, we'll be down for six hours, a day, a day and a half, and that's endurable. But when you're down for literally weeks and then months, it's a whole different story."
A good BCP, in his description, is a catalog of workflows written by the actual subject matter experts closest to a process, not by whoever owns the document: who does what to whom, in what order, on what timing. "It's the decoder ring to translate whatever process was using your digital capabilities into pure human activity." Some of Clorox's plans held up well. Others didn't, and the team adapted in real time. Whether an old plan is still good, he says, depends entirely on whether your customer requirements or your supplier base, tier one through tier three, has changed technology since it was written. Stale assumptions are where a well-intentioned plan quietly stops working.
Cybersecurity Is Not an IT Department Problem
McDonald has since seen impersonation fraud attempts aimed at Clorox suppliers, including banking detail changes he wouldn't discuss in detail because of pending litigation. His framing is that the CEO-gift-card scam and the six-figure wire fraud attempt are the same failure mode at different stakes. "The impersonating the CEO or the CFO for gift cards is a well-known ruse, but it still trips people up. That lack of attentiveness to your company's cybersecurity, by every single member of the company, this is not just an IT thing." Clorox even audited SCADA systems across its plants and found more equipment-level vulnerabilities than expected, none of them exploited, all of them worth closing before they became the next entry point.
He's watched the sophistication climb, too. "They used to be really clunky, bad syntax, poor grammar, misspelled words. Now they've gotten a lot more sophisticated. It's a real challenge for individuals and enterprises to keep up." Voice and image generation have made it worse. He shares his own version of the story going around: his stepdaughter sent a photo of a stranger sitting at the foot of her bed and a message that she'd just woken up from a nap to find him there. It took an agonizing few minutes and a mother in a full panic before the follow-up text landed: it was AI, a prank, not real. "We had no way to verify it, and we're going crazy."
Advising the Next Wave of Supply Chain Founders
Since leaving Clorox, McDonald has spent roughly a year and a half advising founders building supply chain and procurement software, and he's come away energized by what he calls best-of-breed thinking replacing the old instinct to buy a single sprawling ERP suite. "You don't have to be leveraged by this massive ERP. These are great standalone, single-point solutions." The thing he pushes hardest on with every founder isn't the roadmap, it's time to value. "If you're sitting in the chair I was sitting in, you're always looking for solutions that bring extraordinary value, and the faster I can get to those, the better. Nine months, twelve months to connect, that's just massively too long. It needs to be weeks, if not a month or two."
Asked whether he ever considered building something himself while still inside Clorox, McDonald is direct about the constraint: Clorox was carrying enough technical debt that fixing what already existed left no time to imagine what could exist next. He was, in his words, a better consumer of the technology than a builder of it, and he sees that as a distinct and valuable role in the ecosystem, not a lesser one.
The Procurement Tool Rick Still Wants Built
Pressed on what's missing from the market, McDonald points past his own tier-one suppliers. "As a manufacturer, sometimes it's really hard to get past your tier-one supplier to understand who their two and three and maybe four is." The value isn't negotiating leverage, it's regulatory and reputational: confirming compliance with child labor laws, tracing conflict materials, knowing which countries a company shouldn't be doing indirect business in. Tier-one suppliers resist sharing that visibility today, largely to protect the arm's-length relationship they've built with their own upstream base and their own margins. McDonald thinks a technology solve is possible, but expects the real driver to be pressure trickling down from retailers before tier-one suppliers give up that separation voluntarily.
Sustainability: Everyone Wants It, Almost Nobody Pays for It
The conversation's sharpest turn is on sustainability economics. McDonald has effectively never seen a customer choose a higher-cost supplier for reasons beyond performance. "You ask people if they're interested in reducing waste and reducing what goes to a landfill, and everybody goes, yep, check that box. And then the next question: are you willing to pay a little more for that? Absolutely not." He heard the same line, almost verbatim, from a Kraft Heinz Europe executive on a panel he moderated in Munich, even in a market with heavier regulatory pressure behind sustainability.
His read is that the fix isn't more good intentions, it's collaboration across manufacturers, regulators, and waste removal companies, because right now the economics of aggregating and reprocessing recycled material often don't pencil out. He offers a small, telling example: his own household got a notice from its waste hauler to stop separating glass, because the company had simply stopped collecting it. "There wasn't any incentive. There was no money in it, and they're like, yeah, don't bother, we're not doing it." He points to refills as the clearest case of a good, obvious idea that keeps failing commercially anyway. Clorox has tried them. So have Reckitt and Unilever. "It's not that much more difficult. It's an obvious reuse of a very functional container you bought originally, and yet it's not, and the marketing group hasn't been able to convince the shopper this is something important to them." He's more optimistic about lightweight formats, pointing to dehydrated, single-use cleaning wipes that dissolve in water and cut shipping weight dramatically, as the kind of innovation that survives contact with the checkout line because it doesn't ask the shopper to sacrifice anything to get there.
His closing instinct is that a good idea rarely dies for good. The same solubilizing problem that killed an early Kingsford sawdust pilot got solved years later by a different engineer using a different method, and it became a product claim. "Sometimes the idea, its time is not there. You put it on the shelf, but you got to come back to it, because good ideas, there'll be a time for them at some point."
Guest: Rick McDonald, SVP & Chief Supply Chain Officer, The Clorox Company; advisor to supply chain and AI startups including ketteQ, PopCapacity, and Veren AI
Listen on Spotify | Listen on Apple Podcasts | Listen on Amazon Music
In August 2023, Clorox lost its systems to a cyberattack and didn't get them back for months. Rick McDonald, the company's SVP and Chief Supply Chain Officer at the time, made two calls almost immediately: keep every plant running with no visibility into inventory, and ask the supplier base to hold on payments with no firm date for when the checks would come. Both bets paid off. "We were a hundred days in without making a payment" on some accounts, he tells Spencer, and the relationships held anyway. "That's when you learn about how important your relationships are, how important the way you treated your suppliers over time. They stuck right with us."
McDonald spent nearly 33 years moving through supply chain, first ten years running salty snack plants at Frito-Lay, then almost as many at Clorox, where he eventually oversaw $4 billion in spend under management and a global organization of 6,000 to 9,000 people through COVID, the inflation spike that followed it, and the cyberattack that came after that. He retired from the role in 2024 and now advises founders building the next generation of supply chain software. In this episode, he and Spencer trace that arc: the plant floor instincts that shaped his leadership style, the war room decisions that kept Clorox's factories running on paper, and the uncomfortable truth about why companies say they want sustainable sourcing but almost never pay for it.
Why Thirty-Three Years Was Enough
McDonald had a number in mind before he ever took the Chief Supply Chain Officer job: four years, minimum. He ended up going a bit longer, but as the company moved through an SAP transition and a new operating model, he felt the moment arrive. "I just thought it was probably time for somebody else to give it a run and put their energy and their passion, their expertise against it." He also had itches he couldn't scratch inside a 24/7, 365 executive role: more keynotes, more panels, more mentoring than the job ever left room for. Stepping away didn't mean stepping down in intensity. It meant redirecting it.
From the Plant Floor to $4 Billion in Spend
McDonald never planned on supply chain. Out of Georgia Tech, he took the best offer he could find, which was unpaid work at a metal fabricating plant, because he liked the immediate feedback loop of watching output move. That instinct carried him through five different Frito-Lay manufacturing plants over ten years, an incubator, in his telling, for supervisory and leadership skills.
Clorox recruited him repeatedly before he picked up the phone. At the time it was a $1.7 billion, US-only, family-run company hiring manufacturing sophistication from the outside, the way it pulled marketing talent from Procter & Gamble. McDonald ran an LA plant for five years, then took his first procurement assignment: sourcing for Kingsford Charcoal, then a $400 million business with $70 to $80 million in spend under management. It was early days for strategic sourcing, and McDonald volunteered for one of three internal pilots, a modest $13 million spend that returned $4 million in savings by sourcing new raw materials, materials that eventually let Clorox put a new claim on the bag: charcoal briquettes made with supersaturated sawdust, engineered for better-smelling smoke. The idea itself had failed once before, five or ten years earlier, because nobody had figured out how to get the sawdust to absorb properly. A new engineer solved that problem, and a shelved idea became a product claim.
August 2023: The Systems Went Dark
By the time the cyberattack hit, McDonald's remit covered the full breadth of Clorox's supply chain and procurement organization. The shock of losing systems access gave way almost immediately to a structural problem: Clorox had just shifted manufacturing and planning responsibility out to general managers under a new operating model, and most GMs hadn't grown up as supply chain people. "We agreed that we would revert all those responsibilities and capabilities back to me and my team for all decision-making. We needed one place to make decisions, not twelve."
There was an early push to shut the factories down entirely, since nobody had systems to run them properly. McDonald overruled it. "I said, absolutely not. We're going to run our plants. We're going to maintain inventory manually, and because as soon as we are able to ship product, there's going to be some latency to the demand, and we're going to wish we'd run as hard as we could during that time period." Plants kept building. When they needed outside warehousing to hold the inventory, they went and found it. The bet was that the demand hadn't disappeared, only the ability to fill it, and when systems came back, every case they'd built in the dark would matter.
A Hundred Days Without a Payment
The supplier conversations were the part McDonald expected to be hardest, and they turned out to be the smoothest. Procurement handled most of it directly, and at one point McDonald sent a personal letter to Clorox's strategic suppliers laying out what the company knew, which wasn't everything, and asking them to hold on and trust the relationship. They did. "You know, some of our suppliers were absolutely cash businesses," he says, pointing to the wood scrap and sawdust suppliers behind Kingsford charcoal, businesses that couldn't afford to deliver for free and would have had to sell elsewhere. Clorox found ways, with limited resources, to keep cutting checks to that group. Everyone else was asked to hold, and mostly did, for a stretch that ran up to a hundred days on some accounts. Retail customers showed up the same way, with Walmart, Target, Costco, Kroger, and Publix all asking daily and weekly what they could do to help move product as it became available again. "There was just a lot of grace given, on both sides of the table. I take it back to this relationship we built over time, the trust we had in each other."
Business Continuity Plans Only Prove Themselves Under Pressure
McDonald's team had written business continuity plans and even practiced parts of them before the attack. What nobody plans for, he says, is activating every single one at once, for months instead of hours. "Nobody contemplates having to activate all of their BCPs at the same time, and that's essentially what we did. Most of us think, well, we'll be down for six hours, a day, a day and a half, and that's endurable. But when you're down for literally weeks and then months, it's a whole different story."
A good BCP, in his description, is a catalog of workflows written by the actual subject matter experts closest to a process, not by whoever owns the document: who does what to whom, in what order, on what timing. "It's the decoder ring to translate whatever process was using your digital capabilities into pure human activity." Some of Clorox's plans held up well. Others didn't, and the team adapted in real time. Whether an old plan is still good, he says, depends entirely on whether your customer requirements or your supplier base, tier one through tier three, has changed technology since it was written. Stale assumptions are where a well-intentioned plan quietly stops working.
Cybersecurity Is Not an IT Department Problem
McDonald has since seen impersonation fraud attempts aimed at Clorox suppliers, including banking detail changes he wouldn't discuss in detail because of pending litigation. His framing is that the CEO-gift-card scam and the six-figure wire fraud attempt are the same failure mode at different stakes. "The impersonating the CEO or the CFO for gift cards is a well-known ruse, but it still trips people up. That lack of attentiveness to your company's cybersecurity, by every single member of the company, this is not just an IT thing." Clorox even audited SCADA systems across its plants and found more equipment-level vulnerabilities than expected, none of them exploited, all of them worth closing before they became the next entry point.
He's watched the sophistication climb, too. "They used to be really clunky, bad syntax, poor grammar, misspelled words. Now they've gotten a lot more sophisticated. It's a real challenge for individuals and enterprises to keep up." Voice and image generation have made it worse. He shares his own version of the story going around: his stepdaughter sent a photo of a stranger sitting at the foot of her bed and a message that she'd just woken up from a nap to find him there. It took an agonizing few minutes and a mother in a full panic before the follow-up text landed: it was AI, a prank, not real. "We had no way to verify it, and we're going crazy."
Advising the Next Wave of Supply Chain Founders
Since leaving Clorox, McDonald has spent roughly a year and a half advising founders building supply chain and procurement software, and he's come away energized by what he calls best-of-breed thinking replacing the old instinct to buy a single sprawling ERP suite. "You don't have to be leveraged by this massive ERP. These are great standalone, single-point solutions." The thing he pushes hardest on with every founder isn't the roadmap, it's time to value. "If you're sitting in the chair I was sitting in, you're always looking for solutions that bring extraordinary value, and the faster I can get to those, the better. Nine months, twelve months to connect, that's just massively too long. It needs to be weeks, if not a month or two."
Asked whether he ever considered building something himself while still inside Clorox, McDonald is direct about the constraint: Clorox was carrying enough technical debt that fixing what already existed left no time to imagine what could exist next. He was, in his words, a better consumer of the technology than a builder of it, and he sees that as a distinct and valuable role in the ecosystem, not a lesser one.
The Procurement Tool Rick Still Wants Built
Pressed on what's missing from the market, McDonald points past his own tier-one suppliers. "As a manufacturer, sometimes it's really hard to get past your tier-one supplier to understand who their two and three and maybe four is." The value isn't negotiating leverage, it's regulatory and reputational: confirming compliance with child labor laws, tracing conflict materials, knowing which countries a company shouldn't be doing indirect business in. Tier-one suppliers resist sharing that visibility today, largely to protect the arm's-length relationship they've built with their own upstream base and their own margins. McDonald thinks a technology solve is possible, but expects the real driver to be pressure trickling down from retailers before tier-one suppliers give up that separation voluntarily.
Sustainability: Everyone Wants It, Almost Nobody Pays for It
The conversation's sharpest turn is on sustainability economics. McDonald has effectively never seen a customer choose a higher-cost supplier for reasons beyond performance. "You ask people if they're interested in reducing waste and reducing what goes to a landfill, and everybody goes, yep, check that box. And then the next question: are you willing to pay a little more for that? Absolutely not." He heard the same line, almost verbatim, from a Kraft Heinz Europe executive on a panel he moderated in Munich, even in a market with heavier regulatory pressure behind sustainability.
His read is that the fix isn't more good intentions, it's collaboration across manufacturers, regulators, and waste removal companies, because right now the economics of aggregating and reprocessing recycled material often don't pencil out. He offers a small, telling example: his own household got a notice from its waste hauler to stop separating glass, because the company had simply stopped collecting it. "There wasn't any incentive. There was no money in it, and they're like, yeah, don't bother, we're not doing it." He points to refills as the clearest case of a good, obvious idea that keeps failing commercially anyway. Clorox has tried them. So have Reckitt and Unilever. "It's not that much more difficult. It's an obvious reuse of a very functional container you bought originally, and yet it's not, and the marketing group hasn't been able to convince the shopper this is something important to them." He's more optimistic about lightweight formats, pointing to dehydrated, single-use cleaning wipes that dissolve in water and cut shipping weight dramatically, as the kind of innovation that survives contact with the checkout line because it doesn't ask the shopper to sacrifice anything to get there.
His closing instinct is that a good idea rarely dies for good. The same solubilizing problem that killed an early Kingsford sawdust pilot got solved years later by a different engineer using a different method, and it became a product claim. "Sometimes the idea, its time is not there. You put it on the shelf, but you got to come back to it, because good ideas, there'll be a time for them at some point."
Guest: Rick McDonald, SVP & Chief Supply Chain Officer, The Clorox Company; advisor to supply chain and AI startups including ketteQ, PopCapacity, and Veren AI
Listen on Spotify | Listen on Apple Podcasts | Listen on Amazon Music
In August 2023, Clorox lost its systems to a cyberattack and didn't get them back for months. Rick McDonald, the company's SVP and Chief Supply Chain Officer at the time, made two calls almost immediately: keep every plant running with no visibility into inventory, and ask the supplier base to hold on payments with no firm date for when the checks would come. Both bets paid off. "We were a hundred days in without making a payment" on some accounts, he tells Spencer, and the relationships held anyway. "That's when you learn about how important your relationships are, how important the way you treated your suppliers over time. They stuck right with us."
McDonald spent nearly 33 years moving through supply chain, first ten years running salty snack plants at Frito-Lay, then almost as many at Clorox, where he eventually oversaw $4 billion in spend under management and a global organization of 6,000 to 9,000 people through COVID, the inflation spike that followed it, and the cyberattack that came after that. He retired from the role in 2024 and now advises founders building the next generation of supply chain software. In this episode, he and Spencer trace that arc: the plant floor instincts that shaped his leadership style, the war room decisions that kept Clorox's factories running on paper, and the uncomfortable truth about why companies say they want sustainable sourcing but almost never pay for it.
Why Thirty-Three Years Was Enough
McDonald had a number in mind before he ever took the Chief Supply Chain Officer job: four years, minimum. He ended up going a bit longer, but as the company moved through an SAP transition and a new operating model, he felt the moment arrive. "I just thought it was probably time for somebody else to give it a run and put their energy and their passion, their expertise against it." He also had itches he couldn't scratch inside a 24/7, 365 executive role: more keynotes, more panels, more mentoring than the job ever left room for. Stepping away didn't mean stepping down in intensity. It meant redirecting it.
From the Plant Floor to $4 Billion in Spend
McDonald never planned on supply chain. Out of Georgia Tech, he took the best offer he could find, which was unpaid work at a metal fabricating plant, because he liked the immediate feedback loop of watching output move. That instinct carried him through five different Frito-Lay manufacturing plants over ten years, an incubator, in his telling, for supervisory and leadership skills.
Clorox recruited him repeatedly before he picked up the phone. At the time it was a $1.7 billion, US-only, family-run company hiring manufacturing sophistication from the outside, the way it pulled marketing talent from Procter & Gamble. McDonald ran an LA plant for five years, then took his first procurement assignment: sourcing for Kingsford Charcoal, then a $400 million business with $70 to $80 million in spend under management. It was early days for strategic sourcing, and McDonald volunteered for one of three internal pilots, a modest $13 million spend that returned $4 million in savings by sourcing new raw materials, materials that eventually let Clorox put a new claim on the bag: charcoal briquettes made with supersaturated sawdust, engineered for better-smelling smoke. The idea itself had failed once before, five or ten years earlier, because nobody had figured out how to get the sawdust to absorb properly. A new engineer solved that problem, and a shelved idea became a product claim.
August 2023: The Systems Went Dark
By the time the cyberattack hit, McDonald's remit covered the full breadth of Clorox's supply chain and procurement organization. The shock of losing systems access gave way almost immediately to a structural problem: Clorox had just shifted manufacturing and planning responsibility out to general managers under a new operating model, and most GMs hadn't grown up as supply chain people. "We agreed that we would revert all those responsibilities and capabilities back to me and my team for all decision-making. We needed one place to make decisions, not twelve."
There was an early push to shut the factories down entirely, since nobody had systems to run them properly. McDonald overruled it. "I said, absolutely not. We're going to run our plants. We're going to maintain inventory manually, and because as soon as we are able to ship product, there's going to be some latency to the demand, and we're going to wish we'd run as hard as we could during that time period." Plants kept building. When they needed outside warehousing to hold the inventory, they went and found it. The bet was that the demand hadn't disappeared, only the ability to fill it, and when systems came back, every case they'd built in the dark would matter.
A Hundred Days Without a Payment
The supplier conversations were the part McDonald expected to be hardest, and they turned out to be the smoothest. Procurement handled most of it directly, and at one point McDonald sent a personal letter to Clorox's strategic suppliers laying out what the company knew, which wasn't everything, and asking them to hold on and trust the relationship. They did. "You know, some of our suppliers were absolutely cash businesses," he says, pointing to the wood scrap and sawdust suppliers behind Kingsford charcoal, businesses that couldn't afford to deliver for free and would have had to sell elsewhere. Clorox found ways, with limited resources, to keep cutting checks to that group. Everyone else was asked to hold, and mostly did, for a stretch that ran up to a hundred days on some accounts. Retail customers showed up the same way, with Walmart, Target, Costco, Kroger, and Publix all asking daily and weekly what they could do to help move product as it became available again. "There was just a lot of grace given, on both sides of the table. I take it back to this relationship we built over time, the trust we had in each other."
Business Continuity Plans Only Prove Themselves Under Pressure
McDonald's team had written business continuity plans and even practiced parts of them before the attack. What nobody plans for, he says, is activating every single one at once, for months instead of hours. "Nobody contemplates having to activate all of their BCPs at the same time, and that's essentially what we did. Most of us think, well, we'll be down for six hours, a day, a day and a half, and that's endurable. But when you're down for literally weeks and then months, it's a whole different story."
A good BCP, in his description, is a catalog of workflows written by the actual subject matter experts closest to a process, not by whoever owns the document: who does what to whom, in what order, on what timing. "It's the decoder ring to translate whatever process was using your digital capabilities into pure human activity." Some of Clorox's plans held up well. Others didn't, and the team adapted in real time. Whether an old plan is still good, he says, depends entirely on whether your customer requirements or your supplier base, tier one through tier three, has changed technology since it was written. Stale assumptions are where a well-intentioned plan quietly stops working.
Cybersecurity Is Not an IT Department Problem
McDonald has since seen impersonation fraud attempts aimed at Clorox suppliers, including banking detail changes he wouldn't discuss in detail because of pending litigation. His framing is that the CEO-gift-card scam and the six-figure wire fraud attempt are the same failure mode at different stakes. "The impersonating the CEO or the CFO for gift cards is a well-known ruse, but it still trips people up. That lack of attentiveness to your company's cybersecurity, by every single member of the company, this is not just an IT thing." Clorox even audited SCADA systems across its plants and found more equipment-level vulnerabilities than expected, none of them exploited, all of them worth closing before they became the next entry point.
He's watched the sophistication climb, too. "They used to be really clunky, bad syntax, poor grammar, misspelled words. Now they've gotten a lot more sophisticated. It's a real challenge for individuals and enterprises to keep up." Voice and image generation have made it worse. He shares his own version of the story going around: his stepdaughter sent a photo of a stranger sitting at the foot of her bed and a message that she'd just woken up from a nap to find him there. It took an agonizing few minutes and a mother in a full panic before the follow-up text landed: it was AI, a prank, not real. "We had no way to verify it, and we're going crazy."
Advising the Next Wave of Supply Chain Founders
Since leaving Clorox, McDonald has spent roughly a year and a half advising founders building supply chain and procurement software, and he's come away energized by what he calls best-of-breed thinking replacing the old instinct to buy a single sprawling ERP suite. "You don't have to be leveraged by this massive ERP. These are great standalone, single-point solutions." The thing he pushes hardest on with every founder isn't the roadmap, it's time to value. "If you're sitting in the chair I was sitting in, you're always looking for solutions that bring extraordinary value, and the faster I can get to those, the better. Nine months, twelve months to connect, that's just massively too long. It needs to be weeks, if not a month or two."
Asked whether he ever considered building something himself while still inside Clorox, McDonald is direct about the constraint: Clorox was carrying enough technical debt that fixing what already existed left no time to imagine what could exist next. He was, in his words, a better consumer of the technology than a builder of it, and he sees that as a distinct and valuable role in the ecosystem, not a lesser one.
The Procurement Tool Rick Still Wants Built
Pressed on what's missing from the market, McDonald points past his own tier-one suppliers. "As a manufacturer, sometimes it's really hard to get past your tier-one supplier to understand who their two and three and maybe four is." The value isn't negotiating leverage, it's regulatory and reputational: confirming compliance with child labor laws, tracing conflict materials, knowing which countries a company shouldn't be doing indirect business in. Tier-one suppliers resist sharing that visibility today, largely to protect the arm's-length relationship they've built with their own upstream base and their own margins. McDonald thinks a technology solve is possible, but expects the real driver to be pressure trickling down from retailers before tier-one suppliers give up that separation voluntarily.
Sustainability: Everyone Wants It, Almost Nobody Pays for It
The conversation's sharpest turn is on sustainability economics. McDonald has effectively never seen a customer choose a higher-cost supplier for reasons beyond performance. "You ask people if they're interested in reducing waste and reducing what goes to a landfill, and everybody goes, yep, check that box. And then the next question: are you willing to pay a little more for that? Absolutely not." He heard the same line, almost verbatim, from a Kraft Heinz Europe executive on a panel he moderated in Munich, even in a market with heavier regulatory pressure behind sustainability.
His read is that the fix isn't more good intentions, it's collaboration across manufacturers, regulators, and waste removal companies, because right now the economics of aggregating and reprocessing recycled material often don't pencil out. He offers a small, telling example: his own household got a notice from its waste hauler to stop separating glass, because the company had simply stopped collecting it. "There wasn't any incentive. There was no money in it, and they're like, yeah, don't bother, we're not doing it." He points to refills as the clearest case of a good, obvious idea that keeps failing commercially anyway. Clorox has tried them. So have Reckitt and Unilever. "It's not that much more difficult. It's an obvious reuse of a very functional container you bought originally, and yet it's not, and the marketing group hasn't been able to convince the shopper this is something important to them." He's more optimistic about lightweight formats, pointing to dehydrated, single-use cleaning wipes that dissolve in water and cut shipping weight dramatically, as the kind of innovation that survives contact with the checkout line because it doesn't ask the shopper to sacrifice anything to get there.
His closing instinct is that a good idea rarely dies for good. The same solubilizing problem that killed an early Kingsford sawdust pilot got solved years later by a different engineer using a different method, and it became a product claim. "Sometimes the idea, its time is not there. You put it on the shelf, but you got to come back to it, because good ideas, there'll be a time for them at some point."
Faster sourcing. Lower cost. Less chaos.
See how LightSource connects engineering, procurement, and suppliers in one operating system to help you launch faster at lower cost.
SOC 2
Kearney #1 2024
Gartner Cool Vendor
Procuretech 100
G2 Top Rated
Faster sourcing. Lower cost. Less chaos.
See how LightSource connects engineering, procurement, and suppliers in one operating system to help you launch faster at lower cost.
SOC 2
Kearney #1 2024
Gartner Cool Vendor
Procuretech 100
G2 Top Rated
Faster sourcing. Lower cost. Less chaos.
See how LightSource connects engineering, procurement, and suppliers in one operating system to help you launch faster at lower cost.
SOC 2
Kearney #1 2024
Gartner Cool Vendor
Procuretech 100
G2 Top Rated
Trusted by:
Trusted by:
Trusted by:
*GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally, and COOL VENDORS is a registered trademark of Gartner, Inc. and/or its affiliates and are used herein with permission. All rights reserved. Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.