5 unchanged sentences
The Company's Enterprise Risk Management program and team plays a pivotal role in overseeing the organization's risk posture, specifically focusing on the implementation of a holistic risk management program for overseeing the assessment and appropriate control of information and cybersecurity risks .
−Removed: Annually, the Information and Cyber Security Policy and Program and Risk Assessments are presented for approval to the Board to ensure the program is representative and supportive of the Bank’s risk appetite and security testing expectations.
+Added: Annually, the Information and Cyber Security Policy and Program and Risk Assessments are presented for approval to the Board to ensure the program is representative and supportive of regulatory requirements and the Bank’s risk appetite.
Risks identified are subject to rigorous controls, ensuring both design and operational effectiveness and adherence to regulatory requirements.
−Removed: Instances where a risk is identified as inadequately controlled are promptly reported to Management requiring formal remediation activities that are tracked and reported to the Risk and Technology Committee of the Board, until measures are implemented to reduce the risk to an acceptable level
+Added: Instances where a risk is identified as inadequately controlled are promptly reported to Management requiring formal dispositioning and/or remediation activities and those activities are tracked and reported to the Risk and Technology Committee of the Board, until measures are implemented to reduce the risk to an acceptable level.
Identification of risks is a multifaceted process, encompassing diverse activities such as the execution of formal risk assessments, as described above, management self-disclosures, monitoring of regulatory and interagency authorities, engagement with professional and industry forums, internal and external audits, collaboration with third-party professional services, policy reviews and walkthroughs, adherence to best practice frameworks, leveraging subject matter expertise and industry experience, and maintaining a collaborative relationship with third party service providers/vendors .
1 unchanged sentence
Security testing and assurance activities are performed internally and are outsourced to independent audit and security firms based on factors such as resource capacity, subject matter expertise, regulatory requirements, and the prevailing rate and condition of risk.
−Removed: Daily operational activities are in place to ensure the achievement and implementation of security requirements, including the management of the Bank’s security architecture, monitoring for potential security events or incidents, and the reporting and
−Removed: response to detected threats in our technology environments.
+Added: Daily operational activities are in place to ensure the achievement and implementation of security requirements, including the management of the Bank’s security architecture, monitoring for potential security events or incidents, and the reporting and response to detected threats in our technology environments.
The Information and Cyber Security Policy and Program establishes the additional policies and standards the Bank is required to implement in support of these practices and processes.
10 unchanged sentences
The Risk and Technology Committee meets at least quarterly and receives reports detailing current risks, maturity and functioning of associated processes and controls, and emerging or anticipated risks and threats.
−Removed: Additionally, the Risk and Technology Committee Chair provides a verbal summarized report to the full Board following each quarterly meeting, and as needed on an interim basis to address developing risk.
+Added: Additionally, the Risk and Technology Committee Chair provides a verbal summarized report to the full Board following each quarterly meeting, and as needed on an
+Added: interim basis to address developing risk.
All Risk and Technology Committee reports are available to the full Board for review.
In the event critical matters arise between scheduled meetings, the Chief Risk Officer promptly notifies the Board and Risk and Technology Committee.
−Removed: To further ensure independence and effectiveness, the Board has delegated authority for the Information and Cybersecurity Policy and Program, including the referenced reports, to the Technology Risk Management Director .
−Removed: This position fulfills the role and responsibilities of a Chief Information Security Officer and reports to the Chief Risk Officer who in turn reports independently to the Chair of the Risk and Technology Committee.
+Added: To further ensure independence and effectiveness, the Board has delegated authority for the Information and Cybersecurity Policy and Program, including the referenced reports, to the Technology Risk Management Director, who is also designated as the Chief Information Security Officer.
+Added: This position reports to the Chief Risk Officer who in turn reports independently to the Chair of the Risk and Technology Committee.
Additional layers of oversight are integrated into the program through the Director of Internal Audit, who conducts independent audits of critical information technology and cybersecurity activities.
20 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.