Company: SPRB
Filing Date: 2025-04-18
Form Type: PRE 14A
Source: 0000950170-25-055856
Chunk: 20

Company: SPRUCE BIOSCIENCES, INC.
Filing Date: 2025-04-18
Form: PRE 14A
Chunk 20
---
 these roles may require different outcomes at different times, and the Board believes that retaining flexibility in these decisions is in the best interests of the Company.

In addition, the Company has a separate Chair for each committee of the Board. The Chair of each committee reports periodically to the Board on the activities of their committee in fulfilling their responsibilities as detailed in their respective charters.

#### Role of the Board in Risk Oversight
One of the Board’s key functions is informed oversight of the Company’s risk management process. The Board does not have a standing risk management committee, but rather administers this oversight function directly through the Board as a whole, as well as through various Board standing committees that address risks inherent in their respective areas of oversight. In particular, the Board is responsible for monitoring and assessing strategic risk exposure, such as cybersecurity-related risks, including a determination of the nature and level of risk appropriate for the Company. The Audit Committee has the responsibility to consider and discuss our major risk exposures and the steps our management has taken to monitor and control these exposures, including guidelines and policies to govern the process by which risk assessment and management is undertaken, and to provide oversight assistance in connection with our strategic, financial, operational, information security and data privacy (including cybersecurity), regulatory,

<div align='center'>12</div>

and other risks related to the Company’s business, including compliance programs as established by management and the Board. The Company’s assessment and management of material risks from cybersecurity threats are integrated into the Company’s overall risk management processes. For example, cybersecurity risk is addressed as a component of the Company’s enterprise risk management program, which is evaluated periodically by the Company’s Chief Compliance Officer, which together with the Audit Committee, evaluates material risks from cybersecurity threats against the Company’s overall business objectives and reports to the Board. The Nominating Committee monitors the effectiveness of our corporate governance guidelines. The Compensation Committee of the Board (the “Compensation Committee”) assesses and monitors whether any of our compensation policies and practices has the potential to encourage excessive risk-taking. Typically, the entire Board meets with the personnel in charge of the Company’s risk management efforts at least annually, and the applicable Board committees meet at least annually with the personnel responsible for risk management efforts in the committees’ respective areas of oversight. Both the Board as a whole and the various standing committees receive periodic reports from the head of risk management, as well as incidental reports as matters may arise. It is the responsibility of the committee Chairs to report findings regarding material risk exposures to the Board as quickly as possible.