Bank Directors Seminar, Coeur d'Alene, ID, September 15-17, 2019

MISCONDUCT – BEST PRACTICES BEFORE EVENT  Company must establish standards and procedures to (a) prevent and (b) detect misconduct  Program should include: 1. Compliance and ethics functions separated from line and staff operations 2. Education and practical, relevant training 3. Periodic audits and evaluations, and enhancements 4. Confidential and anonymous methods to report misconduct 5. Incentives and promotions to encourage compliance and ethical conduct 6. If misconduct discovered, methods to adjust compliance program to prevent similar misconduct in future 7. Regular board reports regarding compliance audits and corrections  Senior executive must be responsible, and board must oversee  Violations must be visibly and consistently punished

47

MISCONDUCT – BEST PRACTICES AFTER EVENT  Board as “gatekeeper” of misconduct allegations; board, not management, decides response  First 48 hours after board learns of misconduct are critical

– Information is incomplete and contradictory – Management and advisors may be dismissive  Internal investigation – Role: obtain information – Initial decisions:  Scope now with possible change later?  Who conducts investigation and who supervises?

 What (not whether) is disclosed to regulators, shareholders and public?  Board need or want its own advisors?

48