Company: TFC
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0000092230-25-000020
Chunk: 166

Company: TRUIST FINANCIAL CORP
Filing Date: 2025-02-25
Form: 10-K
Item: Item 2
Chunk 166
---
 risks and the controls required to mitigate them. Complete required risk and compliance training within deadlines. Comply with risk related applicable Truist policies.

•Identification: proactively recognize business concerns, issues, risks, or emerging risks as they arise in day-to-day activities.

•Escalation: speak up, report, and elevate concerns, issues, and risks as soon as possible to appropriate parties.

•Mitigation: consistently execute risk related applicable procedures and processes as designed for day-to-day activities. Maintain and execute effective controls to manage risk within risk appetite. As applicable, complete successful and timely remediation of assigned issues.

The BRC assists the Board in its oversight of the Company’s risk management function. The BRC is responsible for approving and periodically reviewing the Company’s risk management framework and risk management policies as well as monitoring the Company’s risk profile, approving risk appetite statements, and providing input to management regarding Truist’s risk appetite and risk profile.

The RMO is led by the CRO and is responsible for overseeing the identification, measurement, monitoring, management, and reporting of risk. The CRO has direct access to the Board to communicate any risk issues (current or emerging) as well as the performance of the risk management activities throughout the enterprise.

The risk management framework is supported by a three-lines-of-defense structure with unique roles and responsibilities for executing risk management activities, maintaining independent oversight, and providing independent assurance. The 1st line of defense (1LOD) includes the business units which originate and own the risk and GCO, which is described below. The 2nd line of defense (2LOD) is the independent risk management function provided by the RMO. The 3rd line of defense (3LOD) is the independent assurance function provided by Truist Audit Services.

The GCO standardizes first-line risk execution and ownership across the Company in partnership with the business units and enterprise functions. As part of the first-line of defense, the GCO provides risk advice and oversight, issues management, testing, reporting, and business continuity expertise to first-line execution efforts. The GCO coordinates closely with the RMO in executing these responsibilities.

72   Truist Financial Corporation

Truist’s Committee and Risk Reporting Governance Program is designed to provide comprehensive Board and management risk oversight, maintaining a committee governance structure that supports alignment and execution of the risk management framework. The committee structure provides a mechanism to allow for efficient aggregation and escalation of risk information from the business units up to management and ultimately the Board