Company: WBS-PG
Filing Date: 2025-03-03
Form Type: 10-K
Source: 0000801337-25-000004
Chunk: 156

Company: WEBSTER FINANCIAL CORP
Filing Date: 2025-03-03
Form: 10-K
Item: Item 1
Chunk 156
---
 responsible for assessing and managing that risk.

Independent Risk Management, also referred to as the Second Line Function, is responsible for identifying, measuring, monitoring, or controlling risks independently from the Front Line Units and providing effective challenge to the Front Line Units. Independent Risk Management includes Enterprise Risk, which reports to the Chief Risk Officer, and Credit Risk Management which, reports to the Chief Credit Officer.

Internal Audit, also referred to as the Third Line Function, independently assesses Webster’s risk management processes and controls using methodology developed from professional auditing standards and regulatory guidance. Internal Audit undertakes these responsibilities through periodic reviews of Webster’s business activities, operations, and systems, and through special or retrospective reviews that may be specifically requested by the Audit Committee or management. Internal Audit is led by the Chief Audit Executive.

10

Information Risk 

Information risk encompasses Information Technology risk and Information Security risk. Informational Technology risk is the risk that systems handling information and process flows may not meet quality and efficiency standards in line with industry, customer, and regulatory expectations, or may fail, causing outages, or that new systems may not be implemented timely. Information Technology risk also includes the risk that data supporting internal/external reporting and business decisions is not complete, accurate or available timely. Information Security risk is the risk of unauthorized access, use, disclosure, disruption, modification, perusal, inspection, recording, or destruction of electronic or physical data.

Webster proactively manages information risk to systems, people, assets, data, and capabilities by identifying systems and platforms included in its infrastructure and identifying potential risks that could adversely impact Webster systems necessary for daily operations and critical organization activities. Webster seeks to prevent unauthorized access to data by maintaining robust data security programs and tools including maintaining a comprehensive asset inventory, managing access and authorization for hardware and software, maintaining effective identity and access management, implementing endpoint and network defenses, protecting data with encryption, integrity protection and data loss prevention mechanisms and tools, continuous vulnerability monitoring, detecting and assessing threats, performing risk assessments and penetration tests, prioritizing and managing security incidents, and maintaining robust operational resiliency, recovery and security awareness programs. Periodic risk assessments are performed over key technology and security processes, and ongoing monitoring through monthly process reviews is established for identified processes to ensure controls are operating effectively and issues are identified proactively, while maintaining and supporting the overall stated appetite for information risk.

The Chief Information Officer is responsible for information risk oversight. Additionally, the Information Risk Committee is responsible for providing oversight and governance of Information risk.

Reputation Risk 

Reputation risk is