Company: WBS-PG
Filing Date: 2025-03-03
Form Type: 10-K
Source: 0000801337-25-000004
Chunk: 155

Company: WEBSTER FINANCIAL CORP
Filing Date: 2025-03-03
Form: 10-K
Item: Item 1
Chunk 155
---
 cannot be controlled, management may decide to accept these risks, reduce the level of business activity, share or transfer the risks, or withdraw from the activity altogether.

Impacts of risk can be both quantitative and qualitative. Webster maintains a Risk Appetite Statement, which provides the organization with guidance regarding the nature and level of residual risk that the Company is willing to accept in pursuit of its business strategy and financial plans. The Risk Appetite Statement establishes a risk appetite across Level 1 risk categories, which represent the top risks that drive the organization’s risk profile, and defines the level of risk appetite using a 5-point rating scale (minimal to critical). Further delineation and detail is provided at Level 2 and Level 3 to enable more precise risk identification, assessment, and response. Management determines whether the risks it assumes are warranted and within the boundaries expressed in the Risk Appetite Statement. A risk is warranted when it can be identified, understood, measured, monitored, and controlled as part of a deliberate risk/reward strategy. The Risk Appetite Statement contains a set of qualitative risk statements and quantitative Board level metrics along with the Board level tolerances, which are approved by the Board annually. Breaches of approved tolerances are required to be escalated and actioned in a timely manner. 

The Chief Executive Officer is ultimately responsible for all of Webster’s risk-taking activities and for ensuring that an effective enterprise risk management framework is adopted, operationalized, and executed. The Chief Executive Officer sets the tone at the top and reinforces a strong risk culture that values risk self-identification and for holding executives accountable for their adherence to the enterprise risk management framework, appropriately assessing and effectively managing all of the risks associated with their activities and operating within the established risk appetite.

The Company has adopted the Three Line Model of enterprise risk management, in which the First Line manages risks, ensures compliance, performs control activities, and works in coordination with the Second Line, who provides additional expertise, support, and tools, and challenges risk management to enhance efficiency and effectiveness of the control environment. The Third Line provides an independent and objective assurance to management and the Board and assesses whether the First and Second Line functions are operating effectively. Detailed roles and responsibilities for each line are as follows:

Front Line Units, also referred to as First Line Functions, represent process owners that engage in activities designed to generate revenue and reduce expenses, provide operational and technology services, and provide operational support and servicing in the delivery of products or services. Since Front Line Unit activities inherently create risk, the Front Line Units are