Company: CVLT
Filing Date: 2025-06-25
Form Type: DEF 14A
Source: 0001169561-25-000059
Chunk: 12

Company: COMMVAULT SYSTEMS INC
Filing Date: 2025-06-25
Form: DEF 14A
Chunk 12
---
 for our Company. The Board’s involvement in overseeing Commvault’s business strategy informs its assessment of management’s risk tolerance and its determination of an appropriate level of risk.

The Board of Directors considers risk management to varying degrees regularly at its meetings. The Board adjusts its practices with respect to risk oversight as necessary and involves itself in particular areas or business circumstances where the proper exercise of oversight requires it. The Board and senior management may engage outside advisors for risk assessment where warranted.

While the Board has ultimate oversight responsibility for the risk management process, the Board’s standing committees also have responsibility for risk assessment and risk management with respect to matters in their purview.

The Audit Committee is required under its charter to discuss with management and the independent auditor our cybersecurity, IT and financial risks or exposures and to assess the steps management has taken to minimize such risks. The Audit Committee also oversees Commvault’s internal audit function and compliance matters, and reviews with the Chief Trust Officer any legal or compliance matters, including litigation, that may have a material impact on our financial statements, financial condition, or results of operations.

The Talent Management and Compensation Committee assesses compensation-related risk.

The Nominations and Governance Committee addresses management and governance risk, including through its oversight of the succession planning and nominating processes, our Corporate Governance Guidelines, and our corporate sustainability efforts.

The Operating Committee provides oversight on various risk-related matters as determined by the Board and management.

Each of these Board committees reports to the full Board with respect to its risk oversight functions.

At the management level, our CFO and Chief Trust Officer oversee risk-related matters. In addition, we have established disclosure controls to monitor our compliance with securities disclosure obligations and an executive review committee to monitor and approve certain transactions or other corporate matters that deviate from our standard practices. Senior management reports to the Board or an appropriate Board committee regarding risk issues.

The ERMC is responsible for the implementation, maintenance, and execution of our enterprise risk management program. The ERMC meets quarterly, or as needed, to assess, consider, and manage material risks including cybersecurity threats across the business.

Under our Corporate Governance Policies, the Board has complete and open access to any member of management and any employee, as well as any outside advisor or independent advisor retained by the Board, to inquire about risk-related (or other) topics. In addition, our CFO and Chief Trust Officer are available at Board and committee meetings to answer questions relating to risk oversight. Further, because the CEO is a director, he brings a unique perspective on our risk profile and risk assessment to Board