Company: USB-PA
Filing Date: 2025-08-07
Form Type: 10-Q
Source: 0000036104-25-000055
Chunk: 155

Company: US BANCORP \DE\
Filing Date: 2025-08-07
Form: 10-Q
Chunk 155
---
 complete manner in either normal or stressed conditions. Operational risk is the risk to current or projected financial condition and resilience arising from inadequate or failed internal processes or systems, people (including human errors or misconduct), or adverse external events, including the risk of loss resulting from breaches in data security. Operational risk can also include the risk of loss due to failures by third parties with which the Company does business. Compliance risk is the risk that the Company may suffer legal or regulatory sanctions, financial losses, and reputational damage if it fails to adhere to compliance requirements and the Company’s compliance policies. Strategic risk is the risk to current or projected financial condition and resilience arising from adverse business decisions, poor implementation of business decisions, or lack of responsiveness to changes in the banking industry and operating environment. Reputation risk is the risk to current or projected financial condition and resilience arising from negative public opinion. This risk may impair the Company’s competitiveness by affecting its ability to establish new relationships or services, or continue servicing existing relationships. In addition to the risks

identified above, other risk factors exist that may impact the Company. Refer to “Risk Factors” in the Company’s Annual Report on Form 10-K for the year ended December 31, 2024, for a detailed discussion of these factors.

The Company’s Board and management-level governance committees are supported by a “three lines of defense” model for establishing effective checks and balances. The first line of defense, the business lines, manages risks in conformity with established limits and policy requirements. In turn, business line leaders and their risk officers establish programs to ensure conformity with these limits and policy requirements. The second line of defense, which includes the Chief Risk Officer’s organization as well as policy and oversight activities of corporate support functions, translates risk appetite and strategy into actionable risk limits and policies. The second line of defense monitors first line of defense conformity with limits and policies and provides reporting and escalation of emerging risks and other concerns to senior management and the Risk Management Committee of the Board of Directors. The third line of defense, internal audit, is responsible for providing the Audit Committee of the Board of Directors and senior management with independent assessment and assurance regarding the effectiveness of the Company’s governance, risk management and control processes.

Management regularly provides reports to the Risk Management Committee of the Board of Directors. The Risk Management Committee discusses with management the Company’s risk management performance and provides a summary of key risks to the entire Board of Directors, covering the status of existing matters, areas of potential future concern and specific information on certain types of loss events. The