Company: TFC
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0000092230-25-000020
Chunk: 175

Company: TRUIST FINANCIAL CORP
Filing Date: 2025-02-25
Form: 10-K
Item: Item 2
Chunk 175
---
 adopted a technology risk framework that provides the foundation for its technology risk strategy, program, and oversight and defines key objectives, operating model components, risk domains, and capabilities to manage this risk.

Refer to Item 1C, “Cybersecurity” for a discussion regarding Truist’s cybersecurity risk management, strategy, and governance.

Data Analytics, AI, and Generative AI Risks

Data risk is the risk to current or projected financial condition, operations, strategic objectives, and regulatory compliance arising from inadequate data accuracy, completeness, consistency, timeliness, relevance, integrity, and validity (i.e., data fidelity). Inadequate data fidelity can negatively impact regulatory and management reporting, public disclosures, and business decisions.

Truist recognizes the importance of maintaining accurate and reliable data and maintains a formal data risk management program that is designed to mitigate risks related to data fidelity. Through active data risk monitoring and accuracy testing, Truist seeks to provide reasonable assurance over data-related processes, risks, and controls, as well as the quality and retention of key data used for operational, strategic, regulatory, and compliance purposes. Management and the Board provide oversight of the data risk management program and receive regular updates from the RMO.

Truist’s AI program is foundationally based on the National Institute of Standards and Technology AI Risk Management Framework Core, which provides outcomes and actions that enable dialogue, understanding, and activities to manage AI risks and develop trustworthy AI systems.

78   Truist Financial Corporation

Compliance Risk

Compliance risk is the risk of legal or regulatory sanctions, financial loss, or damage to reputation as a result of noncompliance with (i) applicable laws, regulations, rules or other regulatory requirements (for example, the risk of consumer or wholesale clients experiencing economic loss or other legal harm as a result of noncompliance with relevant laws, requirements or regulations, such as the BSA and its related laws and regulations); (ii) internal policies and procedures, standards of best practice or codes of conduct; and (iii) principles of integrity and fair dealing applicable to Truist’s activities and functions.

Strategic Risk

Strategic risk is the risk to earnings, capital, franchise value, stakeholder confidence, and human capital arising from ineffective strategy, inability to adapt to changes in operating environment, adverse business decisions, or improper execution of strategic initiatives.

Reputational Risk

Reputational risk is the risk to current or future earnings, capital and resilience arising from negative publicity or stakeholder opinion, whether real or perceived,