Company: KEY-PI
Filing Date: 2025-08-05
Form Type: 10-Q
Source: 0000091576-25-000110
Chunk: 63

Company: KEYCORP /NEW/
Filing Date: 2025-08-05
Form: 10-Q
Item: Item 2
Chunk 63
---
 risk are separate risk disciplines in KeyCorp’s ERM framework, losses and/or additional regulatory compliance costs 

45

are included in operational loss reporting and could take the form of explicit charges, increased operational costs, or harm to our reputation.

We seek to mitigate operational risk through identification and measurement of risk, alignment of business strategies with risk appetite and tolerance, and a system of internal controls and reporting. We continuously strive to strengthen our system of internal controls to improve the oversight of our operational risk and to ensure compliance with laws, rules, and regulations. For example, an operational event database tracks the amounts and sources of operational risk and losses. This tracking mechanism helps to identify weaknesses and to highlight the need to take corrective action. We also rely upon software programs designed to assist in assessing operational risk and monitoring our control processes. This technology has enhanced the reporting of the effectiveness of our controls to senior management and the Board.

The Operational Risk Management Program provides the framework for the structure, governance, roles, and responsibilities, as well as the content, to manage operational risk for Key. The Compliance Risk Management Program serves the same function in managing compliance risk for Key. The Operational Risk Committee and the Compliance Risk Committee support the ERM Committee by identifying early warning events and trends, escalating emerging risks, and discussing forward-looking assessments. Both the Operational Risk Committee and the Compliance Risk Committee include attendees from each of the Three Lines of Defense. Primary responsibility for managing and monitoring internal control mechanisms lies with the managers of our various lines of business. The Operational Risk Committee and Compliance Risk Committee are senior management committees that oversee our level of operational and compliance risk and direct and support our operational and compliance infrastructure and related activities. These committees and the Operational Risk Management and Compliance Risk Management functions are an integral part of our ERM Program. Our Internal Audit function regularly assesses the overall effectiveness of our Operational Risk Management and Compliance Risk Management Programs and our system of internal controls. Internal Audit reports the results of reviews on internal controls and systems to senior management and the Audit Committee and updates the Risk Committee, as appropriate, on matters related to the oversight of these controls.

Cybersecurity

For information on our cybersecurity risk management and governance practices, please see Item 1C. Cybersecurity beginning on page 43 of our 2024 Form 10-K.

GAAP to Non-GAAP Reconciliations

Non-GAAP financial measures have inherent limitations, are not required to be uniformly applied, and are not

audited. Although these non-GAAP financial measures are