Company: WFC-PC
Filing Date: 2025-03-19
Form Type: DEF 14A
Source: 0000072971-25-000090
Chunk: 23

Company: WELLS FARGO & COMPANY/MN
Filing Date: 2025-03-19
Form: DEF 14A
Chunk 23
---
 all compliance programs under their remit. 
 •Internal Audit acts as an independent assurance function and validates that the risk management program is adequately designed and functioning effectively.                                                                                                                                                                                                                                                                                                                                                                                   |

#### 2025 Proxy Statement35

#### Board and Governance Matters

### Management Governance
The Company has also established management governance committees, including those focused on risk, that support management in carrying out its governance and risk management responsibilities. Each management governance committee is expected to discuss, document, make decisions regarding, and report on risk matters.

The Company periodically engages third-party advisors and experts to assist in the development and maintenance of its risk management programs, policies, and practices. The reports and views of these third parties may be shared with the Board and relevant Board committees, as appropriate.

Key Areas of Board Oversight

Information Security Risk Oversight

The Risk Committee has primary oversight responsibility for information security risk, which includes cybersecurity risk.

| Board Oversight                                                                                                                                                                                                                                            |
| The Board receives periodic reporting from the Head of Technology regarding Wells Fargo’s information security program and receives reports from management on significant information security developments, including incidents involving third parties. |
| Risk Committee                                                                                                                                                                                                                                             
 •The Risk Committee has primary oversight responsibility for information security risk and approves the Company’s information security program, which includes information protection and cyber resiliency.                                                
 •The Risk Committee receives regular reports from the Company’s Head of Technology and the Company’s Chief Information Security Officer on information security risks, including cybersecurity.                                                            |

At the management level, Operational Risk Management (which is part of the Company’s Independent Risk Management organization) has oversight responsibility for information security risk. As a second line of defense, Operational Risk Management:

• reviews and provides guidance to the Front Line technology team, including with respect to the development and maintenance of risk management policies, governance documents, processes, and controls; and

• oversees and challenges the Front Line technology team’s risk assessment activities.

For additional information on information security risk management, see the “Financial Review - Risk Management - Operational Risk Management” section of Exhibit 13 to the Company’s Annual Report on Form 10- K for the year ended December 31, 2024.

#### 36Wells Fargo & Company

#### Board and Governance Matters
Human Capital Risk Oversight

Our Board, directly and through the HRC, oversees human capital risk and human capital management, in addition to our culture and ethics, as discussed below.

| Board Oversight                                                                                                                                                                                                                                                                                                                                  |
| For certain matters, the Board provides oversight directly, rather than through its committees. For example