Company: NWBI
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0001471265-25-000016
Chunk: 16

Company: Northwest Bancshares, Inc.
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1
Chunk 16
---
”) on risk management matters.

8

•The “third line of defense” is comprised of the Internal Audit organization. The third line of defense provides an independent review and objective assessment of the design and operating effectiveness of the first and second lines of defense, governance, policies, procedures, processes and internal controls, and reports its findings to executive management and the Board, through the Audit Committee. Internal Audit is responsible for performing periodic, independent reviews and testing compliance with the Company’s and the Bank’s risk management policies and standards, as well as with regulatory guidance and industry best practices. Internal Audit also assesses the design of the Company’s and the Bank’s policies and standards and validates the effectiveness of risk management controls and reports the results of such reviews to the Audit Committee.

Management Committees. The ERMC is the highest-management-level committee at the Bank to oversee risks and is responsible for risk governance and oversight and makes recommendations on the Bank’s risk appetite. The ERMC monitors compliance with limits and related escalation requirements and oversees implementation of risk policies.

In addition to the ERMC, we maintain the following management-level committees to oversee our risk categories: Compliance Risk Management Committee; Credit Committee; Model Risk Management Committee; Operational Risk Management Committee; and the Asset/Liability Committee. Each of these Committees is responsible for one or more of the Bank’s eight risk categories, which are described in greater detail below under the heading “Risk Categories”. For its risk category(ies) of responsibility, each Committee provides risk governance, risk oversight and monitoring. Each Committee reviews key risk exposures, trends and significant compliance matters, and provides guidance on steps to monitor, control and escalate significant risks. We include the risk information provided by the ERMC, and these management-level risk committees, along with additional risk information that is identified at the holding company level in our determination and assessment of the risks that are presented to and discussed with our Board and Board Committees.

Risk Categories. We evaluate the potential impact of a risk event on us by assessing the customer, partner, financial, reputational, and legal and regulatory impacts and have divided risk into the following categories.

Compliance Risk. Risk arising from violations of consumer protection laws and/or or regulations, and/or nonconformance with policies and procedures. This risk exposes Northwest to regulatory enforcement actions, fines, civil money penalties, customer reimbursement, and/or statutory or punitive damages. This can further result in diminished reputation, limited business opportunities, and/or merger and acquisition restrictions.

Our Compliance organization is responsible for establishing and maintaining our Compliance Management System. We seek