Company: CMA
Filing Date: 2025-02-24
Form Type: 10-K
Source: 0000028412-25-000108
Chunk: 357

Company: COMERICA INC
Filing Date: 2025-02-24
Form: 10-K
Item: Item 1C
Chunk 357
---
 management reports appropriate to its scope of review, covering matters such as assessment results, risk ratings and critical issues. They report significant matters to enterprise-wide risk committees overseeing the broad scope of risk management for the enterprise as appropriate. Through these and other efforts, senior management makes decisions and sets priorities in allocating resources to address risk management issues.

28

The Board’s Enterprise Risk Committee oversees Comerica’s risk management policies, procedures and practices, including those related to cybersecurity. Senior management generally reports quarterly, or more often as necessary, to the Enterprise Risk Committee on technology risks, including risks from cybersecurity threats. The Board’s Audit Committee and the Board as a whole, also receive such reports as part of their risk management oversight roles. Board members have direct access to senior management (and others, at their request) on matters related to cybersecurity threats and may direct questions to senior management and request further information as they see fit to fulfill their oversight responsibilities.