Company: CMA
Filing Date: 2025-02-24
Form Type: 10-K
Source: 0000028412-25-000108
Chunk: 325

Company: COMERICA INC
Filing Date: 2025-02-24
Form: 10-K
Item: Item 1
Chunk 325
---
 Corporation recognizes the need to identify and control operational losses and seeks to limit losses to a level deemed appropriate by management, as outlined in the Corporation’s risk appetite statement. The appropriate risk level is determined through consideration of the nature of the Corporation's business and the environment in which it operates, in combination with the impact from, and the possible impact on, other risks faced by the Corporation. Operational risk is mitigated through a system of internal controls that are designed to keep operating risks at appropriate levels. The Operational Risk Management Committee monitors risk management techniques and systems. The Corporation has developed a framework that includes a centralized operational risk reporting function in the Enterprise Risk Division and business/support unit risk liaisons responsible for managing operational risk specific to the respective business lines.

Technology Risk

    Technology risk represents the risk of loss or adverse outcomes arising from the people, processes, applications and infrastructure that support the technology environment. The Corporation's definition of technology risk includes technology delivery risk, technology investment risk, cybersecurity risk, information security risk and information management risk. Technology risk is inclusive of the risks associated with the execution of technology processes and activities by third-party contractors and suppliers to the Corporation. Other risk types may materialize in the event of a technology risk event, such as 

F-34

the risk of a financial reporting error or regulatory non-compliance, and the impact of such risks are highly interdependent with operational risk.

    The Technology Risk Committee, comprising senior and executive business unit managers, as well as managers responsible for technology, cybersecurity, information security and enterprise risk management, oversees technology risk. The Technology Risk Committee also ensures that appropriate actions are implemented in business units to mitigate risk to an acceptable level.

Compliance Risk

Compliance risk represents the risk of sanctions or financial loss resulting from the Corporation's failure to comply with all applicable laws, regulations and standards of good banking practice. The impact of such risks is highly interdependent with strategic risk, as the reputational impact from compliance failures can be severe. Activities which may expose the Corporation to compliance risk include, but are not limited to, those dealing with the prevention of money laundering, privacy and data protection, community reinvestment initiatives, fair lending, consumer protection, employment and tax matters, over-the-counter derivative activities and other regulated activities.

The Enterprise-Wide Compliance Committee, comprising senior and executive business unit managers, as well as managers responsible for compliance, audit and overall risk, oversees compliance risk. This enterprise-wide approach provides a consistent view of compliance across the organization. The Enterprise-Wide Compliance Committee also