## RISK MANAGEMENT 

Managing risk is an essential component of successfully operating a financial services company. The Bancorp’s risk management approach includes processes for identifying, assessing, managing, monitoring and reporting risks. The ERM division, led by the Bancorp’s Chief Risk Officer, ensures the consistency and adequacy of the Bancorp’s risk management approach within the structure of the Bancorp’s affiliate operating model. In addition, the Internal Audit division provides an independent assessment of the Bancorp’s internal control structure and related systems and processes. 

The assumption of risk requires robust and active risk management practices that comprise an integrated and comprehensive set of activities, measures and strategies that apply to the entire organization. The Bancorp has established a Risk Appetite Framework that provides the foundations of corporate risk capacity, risk appetite and risk tolerances. The Bancorp’s risk capacity is represented by its available financial resources. Risk capacity sets an absolute limit on risk-assumption in the Bancorp’s annual and strategic plans. The Bancorp’s policy currently discounts its risk capacity by five percent to provide a buffer; as a result, the Bancorp’s risk appetite is limited by policy to 95% of its risk capacity. 

Economic capital is the amount of unencumbered financial resources necessary to support the Bancorp’s risks. The Bancorp measures economic capital under the assumption that it expects to maintain debt ratings at strong investment grade levels over time. The Bancorp’s capital policies require that the economic capital necessary in its business not exceed its risk capacity less the aforementioned buffer. 

Risk appetite is the aggregate amount of risk the Bancorp is willing to accept in pursuit of its strategic and financial objectives. By establishing boundaries around risk taking and business decisions, and by incorporating the needs and goals of its shareholders, regulators, rating agencies and customers, the Bancorp’s risk appetite is aligned with its priorities and goals. Risk tolerance is the maximum amount of risk applicable to each of the eight specific risk categories included in its Enterprise Risk Management Framework. This is expressed primarily in qualitative terms. The Bancorp’s risk appetite and risk tolerances are supported by risk targets and risk limits. Those limits are used to monitor the amount of risk assumed at a granular level. 

The risks faced by the Bancorp include, but are not limited to, credit, market, liquidity, operational, regulatory compliance, legal, reputational and strategic. Each of these risks is managed through the Bancorp’s risk program. ERM includes the following key functions: 

• Enterprise Risk Management Programs is responsible for developing and overseeing the implementation of risk programs and reporting that facilitate a broad integrated view of risk. The department also leads the ongoing development of a strong risk management culture and the framework, policies and committees that support effective risk governance; 

• Commercial Credit Risk Management provides safety and soundness within an independent portfolio management framework that supports the Bancorp’s commercial loan growth strategies and underwriting practices, ensuring portfolio optimization and appropriate risk controls; 

• Risk Strategies and Reporting is responsible for quantitative analysis needed to support the commercial dual grading system, ALLL methodology and analytics needed to assess credit risk and develop mitigation strategies related to that risk. The department also 

provides oversight, reporting and monitoring of commercial underwriting and credit administration processes. The Risk Strategies and Reporting department is also responsible for the economic capital program; 

• Consumer Credit Risk Management provides safety and soundness within an independent management framework that supports the Bancorp’s consumer loan growth strategies, ensuring portfolio optimization, appropriate risk controls and oversight, reporting, and monitoring of underwriting and credit administration processes; 

• Operational Risk Management works with affiliates and lines of business to maintain processes to monitor and manage all aspects of operational risk including ensuring consistency in application of operational risk programs and Sarbanes-Oxley compliance; 

• Bank Protection oversees and manages fraud prevention and detection and provides investigative and recovery services for the Bancorp; 

• Capital Markets Risk Management is responsible for instituting, monitoring, and reporting appropriate trading limits, monitoring liquidity, interest rate risk, and risk tolerances within Treasury, Mortgage, and Capital Markets groups and utilizing a value at risk model for Bancorp market risk exposure; 

• Regulatory Compliance Risk Management ensures that processes are in place to monitor and comply with federal and state banking regulations, including fiduciary compliance processes. The function also has the responsibility for maintenance of an enterprise-wide compliance framework; and 

• The ERM division creates and maintains other functions, committees or processes as are necessary to effectively manage risk throughout the Bancorp. 

Risk management oversight and governance is provided by the Risk and Compliance Committee of the Board of Directors and through multiple management committees whose membership includes a broad cross-section of line of business, affiliate and support representatives. The Risk and Compliance Committee of the Board of Directors consists of five outside directors and has the responsibility for the oversight of risk management for the Bancorp, as well as for the Bancorp’s overall aggregate risk profile. The Risk and Compliance Committee of the Board of Directors has approved the formation of key management governance committees that are responsible for evaluating risks and controls. The primary committee responsible for the oversight of risk management is the ERMC. Committees accountable to the ERMC, which support the core risk programs, are the Corporate Credit Committee, the Operational Risk Committee, the Management Compliance Committee, the Executive Asset Liability Management Committee and the Enterprise Marketing Committee. Other committees accountable to the ERMC oversee the ALLL, capital and community reinvestment act/fair lending functions. There are also new products and initiatives processes applicable to every line of business to ensure an appropriate standard readiness assessment is performed before launching a new product or initiative. Significant risk policies approved by the management governance committees are also reviewed and approved by the Risk and Compliance Committee of the Board of Directors. 

Finally, Credit Risk Review is an independent function responsible for evaluating the sufficiency of underwriting, documentation and approval processes for consumer and commercial credits, the accuracy of risk grades assigned to 

