Governance 15 Board Oversight of Risk Our comprehensive risk management program is conducted by senior management and overseen by the board of directors. In particular, the board oversees management’s identification and prioritization of risks. The full board reviews and approves a corporate policy addressing the delegation of authority and assignment of management responsibility annually. This ensures that the responsibilities and authority delegated to senior management are appropriate from an operational and risk management perspective. The following summarizes the key elements of the roles of the board, senior management and external advisers in our risk management program. y The board oversees risk management, focusing on the most significant risks facing the company, including strategic, operational, financial, legal, environmental, cyber and reputational risks. y Each board committee is integral to risk management and reports specific risk management matters as necessary to the full board. y In 2021, the board established a Sustainability Committee, which oversees sustainability practices and management, including those relating to environmental, health and safety, human rights, and social matters. y Senior management is responsible for day-to- day risk management and conducts a thorough assessment through internal management processes and controls. y The board holds two meetings each year dedicated to its assessment of material risks, including comprehensive evaluations of cybersecurity, environmental, safety, human capital, legal and other facets of risk. y T he chief executive officer and the senior management team brief the board on specific risks throughout the year as needed. y External advisers provide independent advice on specific risks, and review and comment on risk management processes and procedures as necessary. Abrams M1A2 SEPv3