Operations and Technology Committee Charter

Purpose

The Committee is appointed by the Board of Directors to assist the Board in its oversight of (i) the Company’s operations and technology strategy and significant investments in support of such strategy and (ii) operations, technology and operational risk, including information security, fraud, vendor, data protection, business continuity and cybersecurity risks. 

Membership

1. The Committee shall be comprised of at least three Board members appointed by the Board. Committee members shall serve at the pleasure of the Board and for such term as the Board determines. The Board shall designate one Committee member as the Committee’s chair.

Operations

1. The Committee shall hold regular meetings at least four times per year and report to the Board on a regular basis.  Meetings shall include any participants the Committee deems appropriate and shall be of sufficient duration and scheduled at such times as the Committee deems appropriate to discharge properly its responsibilities.  The head of the internal audit department (the “Global Audit Director”) shall generally attend regularly scheduled quarterly meetings of the Committee.

2. The Committee may meet periodically in executive sessions, including with members of management, as appropriate.

3. The Committee may form and delegate to one or more subcommittees all or any portion of the Committee’s authority, duties and responsibilities, and may establish such rules as it determines necessary or appropriate to conduct the Committee’s business.

4. The Committee shall have direct access to, and complete and open communication with, the Company’s management and may obtain advice and assistance from internal legal or other advisors to assist it. The Committee may also retain legal or other advisors.

5. The Company shall provide for appropriate funding, as determined by the Committee, for the payment of (i) ordinary administrative expenses of the Committee that are necessary or appropriate in carrying out its duties and responsibilities and (ii) compensation to legal and other advisors retained by the Committee.

6. The Committee shall review and assess annually its performance and report the results to the Board.

7. The Committee shall review and assess annually the adequacy of this charter and, if appropriate, recommend changes to the charter to the Board.

Authority, Duties and Responsibilities

The Committee shall: 

Oversight of Operations and Technology

1. Receive reports from management, as and when appropriate, on operations and technology strategy and trends that may affect the Company’s strategy, including monitoring of overall industry trends, and significant operations and technology investments.

2. Receive reports from management, as and when appropriate, on operations and technology metrics.

3. Review the Company’s operations and technology strategy and associated budget and expenditures for the Company and its business segments.

4. Review and, as appropriate, make recommendations to the Board regarding significant technology investments in support of the Company’s technology strategy.

5. Review or discuss, as and when appropriate, the Company’s operations and technology policies.

6. Receive reports, as necessary and appropriate, from the Global Audit Director regarding the results of reviews and assessments of the Company’s operations and technology functions.

Oversight of Risk Management

1. Review the major operations, and technology and operational risk exposures of the Company, including information security, fraud, vendor, data protection, business continuity  and cybersecurity risks (including review of cybersecurity risks against established risk management methodologies) and the steps management has taken to monitor and control such exposures.

2. Review or discuss, as and when appropriate, with management, including the Chief Risk Officer, the Company’s risk management and risk assessment guidelines and policies regarding operations, technology and operational risk. 

3. Oversee the Company’s process and significant policies for determining operational risk tolerance and review management’s measurement and comparison of overall operational risk tolerance to established limits.

4. As appropriate, confirm operational risk tolerance levels as set forth in the Risk Appetite Statement.

5. Receive reports from management regarding the Company’s business continuity planning.

Coordination with Management and Other Board Committees

1. Coordinate with management, including the Chief Risk Officer, and with the Audit Committee and the Risk Committee (which coordination may be through the Committee Chair) to help ensure that the committees have received the information necessary to permit them to fulfill their duties and responsibilities with respect to oversight of risk management and risk assessment guidelines and policies. 

Other Authority

1. Have such other authority, duties or responsibilities as may be delegated to the Committee by the Board.

2. Make such recommendations with respect to any of the above and any other matters as the Committee deems necessary or appropriate.