Company: CFG-PE
Filing Date: 2025-03-10
Form Type: DEF 14A
Source: 0000759944-25-000044
Chunk: 31

Company: CITIZENS FINANCIAL GROUP INC/RI
Filing Date: 2025-03-10
Form: DEF 14A
Chunk 31
---
 Company’s risk appetite is embedded into key decision-making processes.

The ERMGF is implemented through a Three Lines of Defense model which incorporates (1) front line units responsible for identifying, assessing, controlling, monitoring and reporting risk; (2) independent risk management which provides independent challenge and oversight of our overall risk profile; and (3) internal audit and credit review functions which evaluate the design and effectiveness of the Company’s risk framework. The ERMGF incorporates both quantitative and qualitative methods for the identification and assessment of risks and events, including ongoing risk and control self-assessment, and frequent scenario analyses. The model is designed to ensure effective management, control and oversight of all risks including liquidity risk, credit risk, price risk, interest rate risk, strategic risk, reputation risk, compliance risk, operational risk, technology risk, and security, fraud, and financial crimes risk.

#### Citizens Financial Group33

#### Corporate Governance Matters
| BOARD                                                                                                  
 OF DIRECTORS                                                                                           |     |            |     |                                                                                                                                                                                                                    |     |      |     |                                                                                                                                                                                       |     |                   |     |                                                                                                                                                    |     |                                   |     |                                                                                                              |
|                                                                                                        |     | COMMITTEES |     |                                                                                                                                                                                                                    |     |      |     |                                                                                                                                                                                       |     |                   |     |                                                                                                                                                    |     |                                   |     |                                                                                                              |
|                                                                                                        |     | AUDIT      |     |                                                                                                                                                                                                                    |     | RISK |     |                                                                                                                                                                                       |     | COMPENSATION & HR |     |                                                                                                                                                    |     | NOMINATING & CORPORATE GOVERNANCE |     |                                                                                                              |
| •Oversees enterprise risk and risk management strategies, policies, procedures, and mitigation efforts 
 •Oversees Cybersecurity risk                                                                           
 •Oversees utility operations, strategy, and safety                                                     
 •Oversees capital allocation related to sustainability initiatives                                     |     |            |     | •Oversees evaluation of systems of internal control, financial reporting, and public disclosure                                                                                                                    
 •Reviews the accuracy and completeness of financial results                                                                                                                                                        
 •Oversees our Conduct Office, which monitors colleague behavior in relation to our Code of Business Conduct and Ethics, sales practices, and other key policy considerations                                       |     |      |     | •Oversees design, implementation and operation of the ERMGF, which sets standards for the identification, assessment, monitoring and control of material risks and related governance 
 •Reviews and, as it deems appropriate, recommends to the Board the implementation of the