Company: ABM
Filing Date: 2025-02-14
Form Type: DEF 14A
Source: 0000950170-25-020776
Chunk: 22

Company: ABM INDUSTRIES INC /DE/
Filing Date: 2025-02-14
Form: DEF 14A
Chunk 22
---
 stemming from the evaluations. The evaluation results have led to changes designed to increase our Board’s effectiveness and efficiency. For example, in recent years, as a result of the evaluations, enhancements have been made regarding Board and committee meeting materials and discussion topics, the structure and responsibilities of the Board’s committees, executive session discussions, committee reports to the Board, as well as the Board’s evaluation process.

The Board’s Oversightof Risk Management

Company management is responsible for day-to-day risk management activities, including the continuing development and implementation of our enterprise risk management (“ERM”) program. Our ERM processes are designed to work across the Company to assess, govern and manage risks identified by management in the short-, intermediate- and long-term and manage the Company’s responses to those risks. Management performs an annual risk assessment,

10ABM Industries Incorporated 2025 Proxy Statement

| ____________________________________________________________________________________ |

which considers industry trends, benchmarks and internal surveys of key employees. In fiscal year 2024 the Company’s management again engaged an independent third-party expert to assist the Company in its enterprise risk identification and assessment processes. The third-party’s review included (i) potential future enterprise risks, (ii) feedback regarding management’s risk appetite and risk evaluation processes, and (iii) assistance in executing and evaluating the outcomes of the Company’s annual risk identification and assessment processes.

The Board, acting directly and through its committees, is responsible for the oversight of management’s ERM process and the Company’s risk management programs and processes generally, including oversight of the Company’s business to evaluate whether systemic risks are being adequately addressed. The Board is also responsible for periodically reviewing and overseeing the Company’s risk management and strategy related to its cybersecurity programs, policies, and practices, including (i) the Company’s processes for assessing, identifying, managing, and mitigating material risks from cybersecurity threats and emerging cybersecurity developments and threats; (ii) whether any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect the Company; (iii) the expertise of members of management with respect to assessing and managing risks from cybersecurity threats; and (iv) the Company’s disclosure controls and procedures with respect to material cybersecurity threats and incidents.

Our Stakeholder and Enterprise Risk Committee assists the Board in its oversight of the Company’s ERM program, including providing input with respect to the risks identified in the ERM process (e.g., changes in significant risks), identification and potential impacts of emerging risks, and discussions with management about how such risks are being mitigated by the Company. Management regularly provides