## Governance and oversight 

The Firm’s overall appetite for risk is governed by a “Risk Appetite” framework. The framework and the Firm’s risk appetite are set and approved by the Firm’s Chief Executive Officer (“CEO”), Chief Financial Officer (“CFO”) and Chief Risk Officer (“CRO”). LOB-level risk appetite is set by the respective LOB CEO, CFO and CRO and is approved by the Firm’s CEO, CFO and CRO. Quantitative parameters and qualitative factors are used to monitor and measure the Firm’s capacity to take risk consistent with its stated risk appetite. Quantitative parameters have been established to assess select strategic risks, credit risks and market risks. Qualitative factors have been established to assess select operational risks, and impact to the Firm’s reputation. Risk Appetite results are reported quarterly to the Board of Directors’ Risk Policy Committee (“DRPC”). 

The Firm has an Independent Risk Management (“IRM”) function, which consists of the Risk Management and Compliance organizations. The CEO appoints, subject to DRPC approval, the Firm’s CRO to lead the IRM organization and manage the risk governance structure of the Firm. The framework is subject to approval by the DRPC in the form of the primary risk management policies. The Firm’s CRO oversees and delegates authorities to LOB CROs, Firmwide Risk Executives (“FREs”), and the Firm’s Chief Compliance Officer (“CCO”). The CCO oversees and delegates authorities to the LOB CCOs, and is responsible for the creation and effective execution of the Global Compliance Program. 

The Firm places reliance on each of its LOBs and other functional areas giving rise to risk to operate within the parameters identified by the IRM function, and within its own management-identified risk and control standards. Each LOB and Treasury and CIO, inclusive of their aligned Operations, Technology and Control Management are considered the “first line of defense” and owns the identification of risks, as well as the design and execution of controls, inclusive of IRM- specified controls, to manage those risks. The first line of defense is responsible for adherence to applicable laws, rules, and regulations and for the implementation of the risk management structure (which may include policy, standards, limits, thresholds and controls) established by IRM. 

The IRM function is independent of the businesses and is “the second line of defense”. The IRM function sets and oversees the risk management structure for firmwide risk governance, and independently assesses and challenges the first line of defense risk management practices. IRM is also responsible for its own adherence to applicable laws, rules, regulations and for the implementation of policies and standards established by IRM with respect to its own processes. 

The Internal Audit function operates independently from other parts of the Firm and performs independent testing and evaluation of processes and controls across the entire enterprise as the Firm’s “third line of defense”. The Internal Audit Function is headed by the General Auditor, who reports to the Audit Committee. 

In addition, there are other functions that contribute to the firmwide control environment including Finance, Human Resources, Legal, and Control Management. 

