The Risk Oversight Committee shall have the following duties and responsibilities:
(i) oversee the Company’s Enterprise Risk Management Program (ERM) and, at least annually, preview the ERM assessment and process for subsequent review by the Board;
(ii) oversee the development, implementation and operation of policies necessary to identify, assess, monitor and manage all categories of enterprise risk, including strategic, operational, technology, and compliance;
(iii) oversee and monitor the material risk management policies of the Company’s operations;
(iv) oversee and monitor the Company’s risk management framework;
(v) discuss with the Audit Committee and management the Company’s major risk exposures, including operational, compliance, strategic, privacy, cybersecurity, technology, business continuity, third party risks, legal and regulatory risks, any emerging risks, the Company’s policies with respect to risk assessment and risk management, and the steps management has taken to monitor and control these exposures. Without limiting the generality of the foregoing, the Committee shall meet at least quarterly with management regarding the strategy for monitoring and maintaining information security;
(vi) assist in the Board’s oversight of the role of technology in executing the Company’s strategy and supporting the Company’s business and operational requirements;
(vii) oversee and monitor the Company’s technology risk management, including but not limited to the Company’s material programs, policies, and safeguards for information technology, cybersecurity and data security;
(xiii) receive and review periodic reports from the Company’s Chief Information Officer concerning the Company’s technology infrastructure and the quality and effectiveness of the Company’s information technology systems and processes;
(ix) report as necessary to the full Board whenever any material risks are identified and any proposed next steps;
(x) coordinate with other committees of the Board regarding the oversight of risks, as appropriate;
(xi) evaluate significant risk exposures of the Company and assess management’s actions to mitigate the exposures in a timely manner;
(xii) review at least annually with the Company’s Global Head of Ethics the implementation and effectiveness of the Company’s compliance and ethics program, including the process for monitoring compliance with the ethics codes and the Company’s annual ethics training program. The Company’s Global Head of Ethics shall have the authority to communicate personally to the Committee promptly on any matter involving criminal conduct or potential criminal conduct that poses a substantial risk to the Company;
15