Company: PCG-PB
Filing Date: 2025-04-10
Form Type: DEF 14A
Source: 0001004980-25-000073
Chunk: 22

Company: PG&E Corp
Filing Date: 2025-04-10
Form: DEF 14A
Chunk 22
---
 overseeing most of the identified risks. Identified enterprise risks are considered when the companies prepare financial disclosures filed with the SEC. Management provides regular reports to the committees on the effectiveness of risk mitigations for each risk, including looking ahead and planning for future conditions, among other things. Management’s risk team and representatives from the functional areas regularly perform horizon scanning exercises, including leveraging academic and other third-party surveys, to assist in the identification of future threats and trends. Each committee provides a report of its activities to the Boards. The specific allocation of Board-level risk oversight was most recently reviewed by the Audit Committees in December 2024.

| Board and Committee Risk Oversight Responsibilities                                                                                                                                                   |     |                                                                                                                                                                                                                                             |
| Boards:Oversee risks associated with major investments and strategic initiatives and cyber-security                                                                                                   |     | People and Compensation:Oversees potential risks arising from the companies’ compensation policies and practices                                                                                                                            |
| Audit:Oversees enterprise risk program, and guidelines and policies that govern the processes by which major risks are assessed and managed. Allocates oversight of specific key risks to committees. |     | Safety and Nuclear Oversight:Oversees risks arising from operations, including wildfire, employee and public safety, electric, gas and generation operations, other risks associated with facilities, emergency response, and cybersecurity |
| Finance and Innovation:Oversees risks associated with financial markets and liquidity                                                                                                                 |     | Sustainability and Governance:Oversees risks associated with climate change                                                                                                                                                                 |

The Boards’ role in risk oversight was not considered by either Board when assessing that Board’s leadership structure. However, each company’s chair has expertise in risk management. Further, the Audit Committees and Safety and Nuclear Oversight Committees play primary roles in Board-level oversight of the companies’ key risks. These committees include either the chair of PG&E Corporation or the chair of the Utility, and the independent Chairs may be consulted regarding the composition of these committees.

#### Cybersecurity
PG&E Corporation and the Utility have identified cybersecurity as a key enterprise risk, which they manage through their enterprise risk management system. PG&E Corporation’s and the Utility’s Boards of Directors, particularly their Safety and Nuclear Oversight Committees, have primary responsibility for overseeing cybersecurity risk management, including reviewing the companies’ cybersecurity policies, controls, and procedures. The Safety and Nuclear Oversight Committees participate in cybersecurity risk reviews to promote alignment in operations and asset management in the implementation of mitigation strategies designed to reduce the risk and impact of cybersecurity threats. In the event that the Safety and Nuclear Oversight Committees identify significant exposures, including with respect to cybersecurity