Purpose
The Committee is appointed by the Board of Directors to assist the Board in its oversight of (i) the Company’s operations and technology, including operations and technology strategy and significant investments in support of such strategy and (ii) operational risk, including information technology, information security, fraud, third-party oversight, business disruption and resilience and cybersecurity risks.
Membership
- The Committee shall be comprised of at least three Board members appointed by the Board after considering the recommendation of the Governance and Sustainability Committee. Committee members shall serve at the pleasure of the Board and for such term as the Board determines. The Board shall designate one Committee member as the Committee’s chair (the “Chair”).
- A majority of the Committee members shall have no material relationship with the Company and shall otherwise satisfy the independence requirements of the Company and the New York Stock Exchange.
Operations
The Committee shall hold regular meetings at least four times per year and report to the Board on a regular basis. Meetings shall include any participants the Committee deems appropriate and shall be of sufficient duration and scheduled at such times as the Committee deems appropriate to discharge properly its responsibilities. The Head of Operations, Head of Technology, Head of Non-Financial Risk and the Chief Audit Officer shall generally attend all regularly scheduled quarterly meetings of the Committee.
The Committee shall meet, as deemed necessary and appropriate, in separate executive sessions with management.
The Committee shall receive information from, and participate in informal meetings and briefings with, management as necessary and appropriate between formal meetings of the Committee. Such briefings and informal meetings may be through the Chair or individual Committee members, as appropriate.
The Committee may form and delegate to one or more subcommittees all or any portion of the Committee’s authority, duties and responsibilities, and may establish such rules as it determines necessary or appropriate to conduct the Committee’s business.
The Committee shall have direct access to, and complete and open communication with, the Company’s management and may obtain advice and assistance from internal legal or other advisors. The Committee may also retain legal or other advisors.
The Company shall provide for appropriate funding, as determined by the Committee, for the payment of (i) ordinary administrative expenses of the Committee that are necessary or appropriate in carrying out its duties and responsibilities and (ii) compensation to legal and other advisors retained by the Committee.
The Committee shall review and assess its performance annually and report the results to the Board.
The Committee shall review and assess the adequacy of this charter annually and, if appropriate, recommend changes to the charter to the Board.
Authority, Duties and Responsibilities
The Committee shall:
Oversight of Operations and Technology
Receive reports, as necessary and appropriate, from management on operations and technology strategy and trends that may affect the Company’s strategy, including monitoring of current and evolving industry trends, and the Company’s significant operations and technology investments.
Receive reports, at least quarterly, from management on operations and technology metrics.
Review the Company’s operations and technology strategy and associated budget and expenditures for the Company and its business segments.
Receive reports and, as necessary and appropriate, make recommendations to the Board regarding the Company’s significant operations and technology investments in support of its technology strategy.
Review and approve, as necessary and appropriate, the Company’s significant operations and technology policies.
Receive reports, as necessary and appropriate, from the Chief Audit Officer regarding the results of reviews and assessments of the Company’s Operations and Technology functions.
Oversight of Risk Management
Review at least quarterly significant operational risk exposures of the Company and its business units, including information technology, information security, fraud, third-party oversight, business disruption and resilience and cybersecurity risks (including review of cybersecurity risks against established risk management methodologies) and the steps management has taken to monitor and control such exposures.
Receive reports, as necessary and appropriate, from management on the Company’s risk management and risk assessment guidelines and policies regarding operational risk.
Receive reports, as necessary and appropriate, regarding emerging operational risks and regulatory matters related to the Committee’s authority, duties and responsibilities as set forth in this charter.
Receive, as necessary and appropriate, reports and recommendations from management and the Company’s management-level Firm Risk Committee on operational risk tolerance.
Oversee the Company’s process and significant policies for determining operational risk tolerance and review management’s measurement and comparison of overall operational risk tolerance to established limits.
As appropriate, confirm operational risk tolerance levels as set forth in the Company’s Risk Appetite Statement.
Oversight of Regulatory Requirements
Review significant risk management regulatory reports and findings of regulators, as applicable to the mandate of the Committee, including management’s remediation plans and progress against such plans.
Coordination with Management and Other Board Committees
Coordinate with management and other committees of the Board (which coordination may be through the committee chairs) to help ensure that the committees have received the information necessary to permit them to fulfill their duties and responsibilities with respect to oversight of risk management and risk assessment guidelines and policies.
Other Authority
Make such recommendations with respect to any of the above matters and any other matters as the Committee deems necessary or appropriate.
Have such other authority, duties and responsibilities as may be delegated to the Committee by the Board.