Company: NWBI
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0001471265-25-000016
Chunk: 58

Company: Northwest Bancshares, Inc.
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1A
Chunk 58
---
 system failure, interruption, or cybersecurity breach affecting our information technology systems, or those of our third-party providers, could damage our reputation, result in a loss of customers and business, violate applicable laws and regulations, subject us to additional regulatory scrutiny, or expose us to litigation, liability or other costs or expenses. Any of these events could have a material adverse effect on our financial condition and results of operations.

In addition, any insurance coverage we may have may not be adequate to compensate for losses from any of the foregoing. We also cannot be sure that such insurance coverage will continue to be available on acceptable terms or at all or that any applicable insurer will not deny coverage as to any future claim.

Our risk management framework may not be effective in mitigating risk and reducing the potential for significant losses.

Our risk management framework is designed to minimize risk and loss to us. We seek to identify, measure, monitor, report and control our exposure to risk, including strategic, market, liquidity, credit, interest rate, compliance and operational risks. While we use a broad and diversified set of risk monitoring and mitigation techniques, these techniques are inherently limited because they cannot anticipate the existence or future development of currently unanticipated or unknown risks. Recent economic conditions and heightened legislative and regulatory scrutiny of the financial services industry, among other developments, have increased our level of risk. Accordingly, we could suffer losses as a result of our failure to properly anticipate and manage these risks.

Our board of directors relies to a large degree on management and outside consultants in overseeing cybersecurity risk management.

The Board of the Company has an Innovation and Technology Sub-Committee, consisting of wholly independent directors chartered, among other items, with a focus on cybersecurity risk. Additionally, the Company’s Board has a designated Risk Management Sub-Committee with the responsibility of monitoring enterprise level risks, including those related to cybersecurity. Furthermore, management of the Company has both an Enterprise Risk Management Committee and an Information Technology Steering 

29

Committee (“ITSC”), both of which are comprised of the most senior members of management, including the Chief Executive Officer, Chief Information Officer (“CIO”), and Chief Operating Officer. The ITSC meets monthly, or more frequently if needed, and the ERMC meets quarterly, or more frequently if needed. Material items related to cybersecurity are reported to the Innovation and Technology and Risk Management Sub-Committees. The Company also engages outside consultants to support its cybersecurity efforts. The directors of the Company do not have significant experience in cybersecurity risk management in other business entities comparable to the Company and