BOARD OF DIRECTORS’ ROLE IN RISK OVERSIGHT
We manage enterprise risk using an integrated framework that includes Board-level oversight, administration by a group of cross-functional
management committees, and day-to-day implementation by a dedicated risk management team led by the CRO. The Board (with input from the Risk Committee) is responsible
for approving the Company’s enterprise-wide risk appetite statement and framework, as well as certain other risk management policies, and oversees the Company’s strategic plan and enterprise-wide risk management program.
The Board regularly devotes time during its meetings to review and discuss the most significant risks facing the Company and management’s
responses to those risks. During these discussions, the President and CEO, the CFO, the CRO, the General Counsel and other members of senior management present management’s assessment of risks, a description of the most significant risks facing
the Company and any mitigating factors and plans or practices in place to address and monitor those risks. The Board has also delegated certain of its risk oversight responsibilities to its committees.
The Risk Committee of the Board has responsibility for the oversight of the risk management program, and the three other board committees have
other oversight roles with respect to risk management within their respective oversight areas. Several management committees and subcommittees have important roles and responsibilities in administering the risk management program. This
committee-focused governance structure provides a forum through which risk expertise is applied cross-functionally to all major decisions, including development of policies, processes and controls used by the CRO and risk management team to execute
our risk management philosophy. The CRO manages our risk management team and is responsible for establishing and implementing standards for the identification, management, measurement, monitoring and reporting of risk on an enterprise-wide basis.
The CRO regularly reports to the Board of Directors and the Risk Committee on risk management matters. The enterprise risk management philosophy is to ensure that all relevant risks are appropriately identified, measured, monitored and controlled.
The approach in executing this philosophy focuses on leveraging risk expertise to drive enterprise risk management using a strong governance framework structure, a comprehensive enterprise risk assessment program and an effective risk appetite
framework.
Responsibility for risk management flows to individuals and entities throughout our Company, including the Board, various
Board and management committees and senior management. The corporate culture and values, in conjunction with the risk management accountability incorporated into the integrated Enterprise Risk Government Framework, which includes a governance
structure and three distinct “Lines of Defense” (as further described below), has facilitated, and will continue to facilitate, the evolution of an effective risk management presence across the Company.
The “First Line of Defense” is comprised of the business areas whose
day-to-day activities involve decision-making and associated risk taking for the Company. As the business owner, the first line is responsible for identifying,
assessing, managing and controlling that risk, and for mitigating our overall risk exposure. The first line formulates strategy and operates within the risk appetite and risk governance framework. The “Second Line of Defense,” also known
as the independent risk management organization, provides oversight of first line risk taking and management. The second line assists in determining risk capacity, risk appetite, and the strategies, policies and structure for managing risks. The
second line owns the risk governance framework. The “Third Line of Defense” is comprised of Internal Audit. The third line provides independent and objective assurance to senior management and to the Board and Audit Committee that first
and second line risk management and internal control systems and its governance processes are well-designed and working as intended.
ATTENDANCE AT MEETINGS
It is our policy that each director is expected to dedicate sufficient time to the performance of his or her duties as a director, including by attending meetings of the stockholders, and meetings of the Board and Board committees
of which he or she is a member.
In 2021, the Board held 10 meetings, including regularly scheduled and special meetings. All directors
attended at least 75% of the aggregate of (i) the total number of meetings of the Board (held during the period for which he or she has been a director); and (ii) the total number of meetings held by all committees on which he or she
served (during the periods for which he or she has served). All directors attended the 2021 Annual Meeting of Stockholders.
