GOLDMAN SACHS GROUP INC

Operational risk is the risk of an adverse outcome resulting from inadequate or failed internal processes, people, systems or from external events. Our exposure to operational risk arises from routine processing errors, as well as extraordinary incidents, such as major systems failures or legal and regulatory matters, that could occur for us or our third-party vendors.

Potential types of loss events related to internal and external operational risk include:

•Execution, delivery and process management;

•Business disruption and system failures;

•Employment practices and workplace safety;

•Clients, products and business practices;

•Third-party risk, including vendor risk;

•Damage to physical assets;

•Internal fraud; and

•External fraud.

Operational Risk, which is part of our second line of defense and reports to our chief risk officer, has primary responsibility for developing and implementing a formalized framework for assessing, monitoring and managing operational risk to support firmwide oversight and challenge of our global businesses, with the goal of maintaining our exposure to operational risk at levels that are within our risk appetite.

Operational Risk Management Process

Our process for managing operational risk includes the critical components of our risk management framework described in the “Overview and Structure of Risk Management,” including a comprehensive data collection process, as well as firmwide policies and procedures, for operational risk events.

We combine top-down and bottom-up approaches to manage and measure operational risk. From a top-down perspective, our senior management assesses firmwide and business-level operational risk profiles. From a bottom-up perspective, our first and second lines of defense are responsible for risk identification and risk management on a day-to-day basis, including escalating operational risks and risk events to senior management.

We seek to maintain a comprehensive control framework designed to provide a well-controlled environment to minimize operational risks. The Firmwide Compliance and Operational Risk Committee is responsible for overseeing compliance and operational risk for our business.

Our operational risk management framework is designed to comply with the operational risk measurement rules under the Capital Framework and has evolved based on the changing needs of our businesses and regulatory guidance.

We have established policies that require all employees and consultants to report and escalate operational risk events. When operational risk events are identified, our policies require that the events be documented and analyzed to determine whether changes are required in our systems and/or processes to further mitigate the risk of future events.

We use operational risk management applications to capture, analyze, aggregate and report operational risk event data and key metrics. One of our key risk identification and control assessment tools is an operational risk and control self-assessment process, which is performed by our managers. This process consists of the identification and rating of operational risks, on a forward-looking basis, and the related controls. The results from this process are analyzed to evaluate operational risk exposures and identify businesses, activities or products with heightened levels of operational risk.

Risk Measurement

We measure our operational risk exposure using both statistical modeling and scenario analyses, which involve qualitative and quantitative assessments of internal and external operational risk event data and internal control factors for each of our businesses. Operational risk measurement also incorporates an assessment of business environment factors, including:

•Evaluations of the complexity of our business activities;

•The degree of automation in our processes;

•New activity information;

•The legal and regulatory environment; and

•Changes in the markets for our products and services, including the diversity and sophistication of our customers and counterparties.

The results from these scenario analyses are used to monitor changes in operational risk and to determine business lines that may have heightened exposure to operational risk. We also perform firmwide stress tests. See “Overview and Structure of Risk Management” for information about firmwide stress tests.

Types of Operational Risks

Increased reliance on technology and third-party relationships has resulted in increased operational risks, such as third-party risk, business resilience risk and cybersecurity risk. See “Cybersecurity Risk Management” for information about our cybersecurity risk management process. We manage third-party and business resilience risks as follows:

Third-Party Risk. Third-party risk, including vendor risk, is the risk of an adverse impact due to reliance on third parties performing services or activities on our behalf. These risks may include legal, regulatory, information security, cybersecurity, reputational, operational or other risks inherent in engaging a third party. We identify, manage and report key third-party risks and conduct due diligence across multiple risk domains, including information security and cybersecurity, resilience and additional supply chain dependencies. We evaluate whether vendors design, implement, and maintain information security controls consistent with our security policies and standards. Vendors that access and process our information on their infrastructure external to our network are required to undergo an initial risk assessment, resulting in the assignment of a vendor inherent risk rating that is determined based on a number of factors, including the type of data stored and processed by a particular vendor. Subsequently, we conduct re-certifications at a depth and frequency that is commensurate with each vendor’s inherent risk rating as a component of our risk-based approach to vendor oversight. Vendors are required to agree to standard contractual provisions before receiving sensitive information from us. These provisions have specific information security control requirements, which apply to vendors that store, access, transmit or otherwise process sensitive information on our behalf. The Third-Party Risk Program monitors, reviews and reassesses third-party risks on an ongoing basis. See “Risk Factors” in Part I, Item 1A of this Form 10-K for further information about third-party risk.

Business Resilience Risk. Business resilience risk is the risk of disruption to our critical processes. We monitor threats and assess risks and seek to ensure our state of readiness in the event of a significant operational disruption to the normal operations of our critical functions or their dependencies, such as critical facilities, systems, third parties, data and/or personnel. Our resilience framework defines the fundamental principles for BCP and crisis management to ensure that critical functions can continue to operate in the event of a disruption. We seek to maintain a business continuity program that is comprehensive, consistent on a firmwide basis, and up-to-date, incorporating new information, including resilience capabilities. Our resilience assurance program encompasses testing of response and recovery strategies on a regular basis with the objective of minimizing and preventing significant operational disruptions. See “Business — Business Continuity and Information Security” in Part I, Item 1 of this Form 10-K for further information about business continuity.

Cybersecurity Risk Management

Cybersecurity risk is the risk of compromising the confidentiality, integrity or availability of our data and systems, leading to an adverse impact to us, our reputation, our clients and/or the broader financial system. We seek to minimize the occurrence and impact of unauthorized access, disruption or use of information and/or information systems. We deploy and operate preventive and detective controls and processes to mitigate emerging and evolving information security and cybersecurity threats, including monitoring our network for known vulnerabilities and signs of unauthorized attempts to access our data and systems. There is increased information risk through diversification of our data across external service providers, including use of a variety of cloud-provided or -hosted services and applications. In addition, new AI technologies may increase the frequency and severity of cybersecurity attacks. See “Risk Factors” in Part I, Item 1A of this Form 10-K for further information about information and cybersecurity risk.

Cybersecurity Risk Management Process

Our cybersecurity risk management processes are integrated into our overall risk management processes described in the “Overview and Structure of Risk Management.” We have established an Information Security and Cybersecurity Program (the Cybersecurity Program), administered by Technology Risk within Engineering, and overseen by our CISO. This program is designed to identify, assess, document and mitigate threats, govern, establish and evaluate compliance with information security mandates, adopt and apply our security control framework, and prevent, detect and respond to security incidents. The Cybersecurity Program is periodically reviewed and modified to respond to changing threats and conditions. A dedicated Operational Risk team, which reports to the chief risk officer, provides oversight and challenge of the Cybersecurity Program, independent of Technology Risk, and assesses the operating effectiveness of the program against industry standard frameworks and Board risk appetite-approved operational risk limits and thresholds.

Our process for managing cybersecurity risk includes the critical components of our risk management framework described in the “Overview and Structure of Risk Management,” as well as the following:

•Training and education, to enable our people to recognize information and cybersecurity threats and respond accordingly;

•Identity and access management, including entitlement management and production access;

•Application and software security, including software change management, open source software, and backup and restoration;

•Infrastructure security, including monitoring our network for known vulnerabilities and signs of unauthorized attempts to access our data and systems;

•Mobile security, including mobile applications;

•Data security, including cryptography and encryption, database security, data erasure and media disposal;

•Cloud computing, including governance and security of cloud applications, and software-as-a-service data onboarding;

•Technology operations, including change management, incident management, capacity and resilience; and

•Third-party risk management, including vendor management and governance, and cybersecurity and business resiliency on vendor assessments.

In conjunction with third-party vendors and consultants, we perform risk assessments to gauge the performance of the Cybersecurity Program, to estimate our risk profile and to assess compliance with relevant regulatory requirements. We perform periodic assessments of control efficacy through our internal risk and control self-assessment process, as well as a variety of external technical assessments, including external penetration tests and “red team” engagements where third parties test our defenses. The results of these risk assessments, together with control performance findings, are used to establish priorities, allocate resources, and identify and improve controls. We use third parties, such as outside forensics firms, to augment our cyber incident response capabilities. We have a vendor management program that documents a risk-based framework for managing third-party vendor relationships. Information security risk management is built into our vendor management process, which covers vendor selection, onboarding, performance monitoring and risk management. See “Third-Party Risk” for further information about vendor risk.

During 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. Technology Risk monitors cybersecurity threats and risks from information security and cybersecurity matters on an ongoing basis, and allocates resources and directs operations in a manner designed to mitigate those risks. For example, in response to the proliferation of AI-enabled fraud and ransomware attacks that continue to be reported globally, we have emphasized phishing and cybersecurity training for our employees and allocated additional resources for business continuity. However, despite these efforts, we cannot eliminate all cybersecurity risks or provide assurances that we have not had occurrences of undetected cybersecurity incidents.

Governance

The Board, both directly and through its committees, including its Risk Committee and Technology Risk Subcommittee, oversees our risk management policies and practices, including cybersecurity risks, and information security and cybersecurity matters. Our chief risk officer, chief information officer and chief technology officer, among others, periodically brief the Board on operational and technology risks, including cybersecurity risks, relevant to us. The Board also receives regular briefings from our CISO on a range of cybersecurity-related topics, including the status of our Cybersecurity Program, emerging cybersecurity threats, mitigation strategies and related regulatory engagements. In addition, these are topics on which various directors maintain an ongoing dialogue with our CISO, chief information officer and chief technology officer.

Our CISO is responsible for managing and implementing the Cybersecurity Program and reports directly to our chief information officer. Our CISO oversees our Technology Risk team, which assesses and manages material risks from cybersecurity threats, sets firmwide control requirements, assesses adherence to controls, and oversees incident detection and response.

In addition, we have a series of committees and steering groups that oversee the implementation of our cybersecurity risk management strategy and framework. These committees and steering groups are informed about cybersecurity incidents and risks by designated members of Technology Risk, who periodically report to these committees and steering groups about the Cybersecurity Program, including the efforts of the Technology Risk teams to prevent, detect, mitigate and remediate incidents and threats. These committees and steering groups enable formal escalation and reporting of risks, and our CISO and other members of Technology Risk provide regular briefings to senior management.

The Firmwide Technology Risk Committee is responsible for reviewing matters related to the design, development, deployment and use of technology. This committee oversees cybersecurity matters, as well as technology risk management frameworks and methodologies, and monitors their effectiveness. This committee is co-chaired by our CISO and our chief technology officer, and reports to the Firmwide Enterprise Risk Committee. To assist the Firmwide Technology Risk Committee in carrying out its mandate, the Firmwide Artificial Intelligence Risk and Controls Committee, which oversees risks associated with the use of AI, reports to the Firmwide Technology Risk Committee. See “Overview and Structure of Risk Management” for further information about this committee.

The Digital Risk Office Steering Group oversees Engineering risk decisions, monitors control performance and reviews approaches to comply with current and emerging regulation applicable to Engineering. This steering group is co-chaired by our CISO, chief technology officer and chief digital risk officer, and reports to the Firmwide Technology Risk Committee.

Our CISO, senior management within Technology Risk and Operational Risk, as well as management personnel overseeing the Cybersecurity Program, all have substantial relevant expertise in the areas of information security and cybersecurity risk management.