Company: FRME
Filing Date: 2025-04-01
Form Type: DEF 14A
Source: 0000712534-25-000077
Chunk: 16

Company: FIRST MERCHANTS CORP
Filing Date: 2025-04-01
Form: DEF 14A
Chunk 16
---
 of the Company’s management and, in particular, its responsibility for the selection, retention and compensation of the CEO.

#### THE BOARD’S ROLE IN RISK OVERSIGHT
Although the entire Board is ultimately responsible for overseeing the Company’s enterprise-wide risk management program, the Board has assigned the primary role for carrying out this responsibility to its Risk and Credit Policy Committee. The Risk and Credit Policy Committee engages in an ongoing review of the Company’s risk policies, procedures and practices and their effectiveness, so that material risks to the Company’s financial well-being can be properly identified, measured, managed, controlled and mitigated. The Board and the Risk and Credit Policy Committee have assigned the principal responsibility for oversight of specific risk categories to other committees in the following areas: the Audit Committee oversees the assessment and management of the Company’s exposure to financial (reporting) risks, and integrity and ethics risks; and the Compensation and Human Resources Committee oversees the assessment and management of the Company’s exposure to risks with respect to the Company’s incentive compensation plans and other executive compensation programs.

In addition, management keeps the Board informed, through the Risk and Credit Policy Committee, of the state of the Company’s cybersecurity posture. The Board administers its risk oversight function, in part, by having management give the Risk and Credit Policy Committee quarterly reports on cybersecurity metrics and an update on preventive measures the Company employs to avoid intrusions. Mr. Sondhi, who is a member of both the Risk and Credit Policy Committee and the Audit Committee, was added to the Company's Board to provide cybersecurity expertise. The Company maintains policies designed to safeguard its data and the data of its customers. The Company requires mandatory annual cybersecurity training for all employees, holds "tabletop" drills to enhance its preparedness for a cyberattack or breach, and maintains cyber insurance coverage. The Board's oversight of the Company's cybersecurity risks is further enhanced by the requirement in the Company's Incident Response Plan that the Board be notified of a cyber-related "Incident" (as defined in the Company's Incident Response Plan). Finally, the Company's Information Security Policy and Incident Response Plan have been updated to further address the Board's role in cybersecurity program oversight, as well as disclosure matters. These updates reflect the SEC's new rule on cybersecurity incident reporting and notification, risk management and governance and oversight, and are discussed in more detail in the Company's 2024 Annual Report on Form 10-K.

The Company's Director Education Plan assures that the directors are updated annually on current risks, emerging risks, and compliance issues