Capital Markets School - October 2023

Internal Use Only

The Lines of Defense - Second As part of the 2LOD, an independent credit risk review unit may evaluate credit risk and the potential exposure to loss associated with managing credit products and processes.

• CRR may be an independent assurance provider organizationally housed within the Company’s RMO and reporting functionally to the Board or a Board Risk Committee (BRC).

7

Internal Use Only

The Lines of Defense - Third

Internal Audit is the third line of defense (3LOD).

• IA provides independent and objective internal audit assurance for the bank. • It evaluates the design and effectiveness of risk management, governance and oversight as well as internal control systems and processes.

8