BANK OF AMERICA CORP /DE/

Strategic risk is embedded in every business and is one of the major risk categories along with credit, market, liquidity, compliance, operational and reputational risks. This risk results from incorrect assumptions about external or internal factors, inappropriate business plans, ineffective business strategy execution, or failure to respond in a timely manner to changes in the regulatory, macroeconomic or competitive environments in the geographic locations in which we operate (e.g., competitor actions, changing customer preferences, product obsolescence and technology developments).

An aspect of strategic risk is the risk that the Corporation’s capital levels are not adequate to meet minimum regulatory requirements and support execution of business activities or absorb losses from risks during normal or adverse economic and market conditions. As such, capital risk is managed in parallel to strategic risk.

We manage strategic risk through the Strategic Risk Enterprise Policy and integration into the strategic planning process, among other activities. Our strategic plan is consistent with our risk appetite, capital plan and liquidity requirements, and specifically addresses strategic risks impacting each business.

On an annual basis, the Board reviews and approves the strategic plan, capital plan, financial operating plan and Risk Appetite Statement. With oversight by the Board, senior management directs the lines of business to execute our strategic plan consistent with our core operating principles and risk appetite. The executive management team monitors business performance throughout the year and provides the Board with regular progress reports on whether strategic objectives and timelines are being met, including reports on strategic risks and if additional or alternative actions need to be

considered or implemented. The regular executive reviews focus on assessing forecasted earnings and returns on capital, the current risk profile, current capital and liquidity positions and related requirements, staffing levels and changes required to support the strategic plan, stress testing results, and other qualitative factors such as market growth rates and peer analysis.

Significant strategic actions, such as capital actions, material acquisitions or divestitures, and resolution plans are reviewed and approved by the Board or delegate. At the business level, processes are in place to discuss the strategic risk implications of new, expanded or modified businesses, products or services, regulatory change and other strategic initiatives, and to provide formal review and approval where required. With oversight by the Board and the ERC, executive management performs similar analyses throughout the year, and evaluates changes to the financial forecast or the risk, capital or liquidity positions as deemed appropriate to balance and optimize achieving the targeted risk appetite, shareholder returns and maintaining the targeted financial strength. Proprietary models are used to measure the capital requirements for credit, country, market, operational and strategic risks. The allocated capital assigned to each business is based on its unique risk profile. With oversight by the Board, executive management assesses the risk-adjusted returns of each business in approving strategic and financial operating plans. The businesses use allocated capital to define business strategies, and price products and transactions.