GOLDMAN SACHS GROUP INC

Effective risk management is critical to our success. Accordingly, we have established an enterprise risk management framework that employs a comprehensive, integrated approach to risk management and is designed to enable comprehensive risk management processes through which we identify, assess, monitor and manage the risks we assume in conducting our activities. Our risk management structure is built around three core components: governance, processes and people.

Governance. Our Board is responsible for overseeing our approach to managing our most significant risks, both directly and through its committees, including its Risk Committee. As part of this oversight, the Board reviews our enterprise risk management framework, as well as our risk appetite statement. The risk appetite statement describes the levels and types of risk we are willing to accept or to avoid in order to achieve our objectives included in our strategy and business plan, while remaining in compliance with regulatory requirements. In addition, the Board reviews our strategy and business plan and is ultimately responsible for overseeing and providing direction about our strategy.

The Board, including through its committees, receives regular briefings on firmwide risks, including liquidity risk, market risk, credit risk, operational risk, model risk and climate risk, from our chief risk officer, on cybersecurity threats and risks from our chief information security officer (CISO), on compliance risk and conduct risk from our chief compliance officer, on legal and regulatory enforcement matters from our chief legal officer, and on other matters impacting our reputation from the chair and/or vice-chairs of our Firmwide Reputational Risk Committee, as well as other members of senior management.

The chief risk officer reports to our chief executive officer and to the Risk Committee of the Board. As part of the review of the firmwide risk portfolio, the chief risk officer regularly advises the Risk Committee of the Board of relevant risk metrics and material exposures, including risk limits and thresholds established in our risk appetite statement.

Enterprise Risk, which reports to our chief risk officer, is responsible for ensuring that our enterprise risk management framework provides the Board and its committees, our risk committees and senior management with a consistent and integrated approach to managing our various risks in a manner consistent with our risk appetite.

Our first line of defense consists of our revenue-producing units, Conflicts Resolution, Controllers, Engineering, Corporate Treasury and certain other corporate functions. The first line of defense is responsible for its risk-generating activities, as well as for the design and execution of controls to mitigate such risks.

Our Risk and Compliance functions are considered our second line of defense and provide independent assessment, review and challenge of the risks taken by our first line of defense, as well as lead and participate in firmwide risk committees.

Internal Audit is considered our third line of defense, and our director of Internal Audit reports to the Audit Committee of the Board and administratively to our chief executive officer. Internal Audit includes professionals with a broad range of audit and industry experience, including risk management expertise. Internal Audit is responsible for independently assessing and validating the effectiveness of key controls, including those within the risk management framework, and providing timely reporting to the Audit Committee of the Board, senior management and regulators.

The three lines of defense structure promotes the accountability of first line risk takers, provides a framework for effective challenge by the second line and empowers independent review from the third line.

Processes. We maintain various processes that are critical components of our risk management framework, including (i) risk identification and assessment, (ii) risk appetite, limits, thresholds and alerts, (iii) control monitoring and testing, and (iv) risk reporting.

•Risk Identification and Assessment. We believe the identification and assessment of our risks is a critical step in providing our Board and senior management transparency and insight into the range and materiality of our risks. We have a comprehensive data collection process, including firmwide policies and procedures that require all employees to report and escalate risk events. Our approach for risk identification and assessment is comprehensive across all risk types, is dynamic and forward-looking to reflect and adapt to our changing risk profile and business environment, leverages subject matter expertise, and allows for prioritization of our most critical risks. We perform risk assessments periodically with the aim of ensuring that our material financial and nonfinancial risks are mitigated through controls to an acceptable tolerance level in accordance with our risk appetite. Our risk assessments include, among other things, the use of stress testing, as well as an assessment of our internal control processes designed to mitigate such risks.

Firmwide stress testing is an important part of our risk management process. It allows us to quantify our exposure to tail risks, highlight potential loss concentrations, undertake risk/reward analysis, and assess and mitigate our risk positions. Firmwide stress tests are performed on a regular basis and are designed to ensure a comprehensive analysis of our vulnerabilities and idiosyncratic risks combining financial and nonfinancial risks, including, but not limited to, credit, market, liquidity and funding, operational and compliance, strategic, systemic and emerging risks into our stress scenarios. We also perform ad hoc stress tests in anticipation of market events or conditions. Stress tests are also used to assess capital adequacy as part of our capital planning and stress testing process. See “Capital Management and Regulatory Capital — Capital Management” for further information.

We maintain a daily discipline of marking substantially all of our inventory to current market levels. We carry our inventory at fair value, with changes in valuation reflected immediately in our risk management systems and in net revenues. We do so because we believe this discipline is one of the most effective tools for assessing and managing risk and that it provides transparent and realistic insight into our inventory exposures.

•Risk Appetite, Limits, Thresholds and Alerts. We apply risk limits, thresholds and alerts to control and monitor risk across transactions, products, businesses and markets. The Board, directly or indirectly through its Risk Committee, approves limits, thresholds and alerts included in our risk appetite statement at firmwide, business and product levels. In addition, the Firmwide Risk Appetite Committee, through delegated authority from the Firmwide Enterprise Risk Committee, is responsible for approving our risk limits, thresholds and alerts policy, subject to the overall limits directly or indirectly approved by the Board, and monitoring these limits.

The Firmwide Risk Appetite Committee is responsible for approving and monitoring limits at firmwide, business and product levels. Certain limits may be set at levels that will require periodic adjustment, rather than at levels that reflect our maximum risk appetite. This fosters an ongoing dialogue about risk among our first and second lines of defense, committees and senior management, as well as rapid escalation of risk-related matters. The Firmwide Risk Appetite Committee also authorizes Risk to set limits and thresholds to support monitoring and oversight at a more granular level. For example, Market Risk sets limits at certain product and desk levels, and Credit Risk sets limits for individual counterparties and their subsidiaries, industries and countries. Limits are reviewed regularly and amended on a permanent or temporary basis to reflect changes to our strategic business plan, as well as changing market conditions, business conditions or risk tolerance. Risks limits are monitored by the respective Risk functions.

•Control Monitoring and Testing. We perform control monitoring and testing to measure the effectiveness of our key controls and to ensure that we are in compliance with policies, codes of conduct, control standards and regulatory requirements. Monitoring and testing is performed by dedicated teams within the first and second lines of defense. These teams establish procedures, develop risk-based annual plans, perform control testing and escalate identified issues.

Issues identified by the dedicated teams, as well as self-identified issues by our employees, are assessed for appropriate escalation and resolution. Where material or thematic issues exist, we develop a plan to remediate them, as appropriate, and monitor the remediation activities.

•Risk Reporting. Effective risk reporting depends on our ability to get the right information to the right people at the right time. Risk reporting is designed to be both forward- and backward-looking and consider detailed information on existing and emerging risk exposures. Risk reporting may include stress testing and scenario analysis, information about the risk profiles for financial and nonfinancial risks, utilization of risk limits and thresholds, details of new and emerging risks identified through our risk identification processes, details of issues, significant internal and external events, and information related to the effectiveness of our controls and remediation plans. As such, we focus on the rigor and effectiveness of our risk systems, with the objective of ensuring that our risk management technology systems provide us with complete, accurate and timely information. Our risk reporting process is designed to take into account information about both existing and emerging risks, thereby enabling our risk committees and senior management to perform their responsibilities with the appropriate level of insight into risk exposures.

We make extensive use of risk committees and councils that meet regularly and serve as an important means to facilitate and foster ongoing discussions to manage and mitigate risks.

We maintain strong and proactive communication about risk and we have a culture of collaboration in decision-making among our first and second lines of defense, committees and senior management. While our first line of defense is accountable and responsible for management of their risk, we dedicate extensive resources to our second line of defense in order to reinforce the importance of having effective oversight and challenge, and a strong culture of escalation and accountability across all functions.

People. Even the best technology serves only as a tool for helping to make informed decisions in real time about the risks we are taking. Ultimately, effective risk management requires our people to interpret our risk data on an ongoing and timely basis and adjust risk positions accordingly. The experience of our professionals, and their understanding of the nuances and limitations of each risk measure, guides us in assessing exposures and maintaining them within prudent levels.

We reinforce a culture of effective risk management, consistent with our risk appetite, in our training and development programs, as well as in the way we evaluate performance, and recognize and reward our people. Our training and development programs, including certain sessions led by our most senior leaders, are focused on the importance of risk management, client relationships and reputational excellence. As part of our performance review process, we assess reputational excellence, including how an employee exercises good risk management and reputational judgment, and adheres to our code of conduct and compliance policies. Our review and reward processes are designed to communicate and reinforce to our professionals the link between behavior and how people are recognized, the need to focus on our clients and our reputation, and the need to always act in accordance with our highest standards.

Structure

Ultimate oversight of risk is the responsibility of our Board. The Board oversees risk both directly and through its committees, including its Risk Committee. We also have a series of committees that generally consist of senior managers, including from both our first and second lines of defense, with specific risk management mandates that have oversight or decision-making responsibilities for risk management activities. We have an established policy for these committees so that appropriate information barriers are in place. Our primary risk committees, most of which also have additional sub-committees, councils or working groups, are described below. In addition to these committees, we have other risk committees that provide oversight for different businesses, activities, products, regions and entities. All of our committees have responsibility for considering the impact on our reputation of the transactions and activities that they oversee.

Membership of our risk committees is reviewed regularly and updated to reflect changes in the responsibilities of the committee members. Accordingly, the length of time that members serve on the respective committees varies as determined by the committee chairs and based on the responsibilities of the members.

The chart below presents an overview of our risk management governance structure.

Management Committee. The Management Committee oversees our global activities. It provides this oversight directly and through delegated authority. This committee consists of our most senior leaders, and is chaired by our chief executive officer. Most members of the Management Committee are also members of other committees. The following are the committees that are principally involved in firmwide risk management.

Firmwide Enterprise Risk Committee. The Firmwide Enterprise Risk Committee is responsible for overseeing all of our financial and nonfinancial risks. As part of such oversight, the committee is responsible for the ongoing review, approval and monitoring of our enterprise risk management framework, as well as our risk limits, and thresholds and alerts policy, through delegated authority to the Firmwide Risk Appetite Committee. The Firmwide Enterprise Risk Committee also reviews new significant strategic business initiatives to determine whether they are consistent with our risk appetite and risk management capabilities. Additionally, the Firmwide Enterprise Risk Committee performs enhanced reviews of significant risk events, the top residual and emerging risks, and the overall risk and control environment in each of our business units in order to propose uplifts, identify elements that are common to all business units and analyze the consolidated residual risks that we face. This committee, which reports to the Management Committee, is co-chaired by our president and chief operating officer and our chief risk officer, who are appointed as chairs by our chief executive officer, and the vice-chair is our chief financial officer, who is appointed as vice-chair by the chairs of the Firmwide Enterprise Risk Committee. The following are the primary committees that report to the Firmwide Enterprise Risk Committee:

•Firmwide New Activity Committee. The Firmwide New Activity Committee is responsible for reviewing new activities and, upon referral by the Firmwide Enterprise Risk Committee, significant strategic business initiatives. Additionally, the Firmwide New Activity Committee may review previously approved activities that are significant and/or that have changed in complexity and/or structure or present different reputational and suitability concerns over time to consider whether these activities remain appropriate. This committee is co-chaired by the head of Finance Risk and a managing director within Controllers, who are appointed as chairs by the chairs of the Firmwide Enterprise Risk Committee.

•Firmwide Technology Risk Committee. The Firmwide Technology Risk Committee is responsible for reviewing matters related to the design, development, deployment and use of technology. This committee oversees cybersecurity matters, as well as technology risk management frameworks and methodologies, and monitors their effectiveness. This committee is co-chaired by our CISO and our chief technology officer, who are appointed as chairs by the chairs of the Firmwide Enterprise Risk Committee. To assist the Firmwide Technology Risk Committee in carrying out its mandate, the Firmwide Artificial Intelligence Risk and Controls Committee, which oversees risks associated with the use of AI, reports to the Firmwide Technology Risk Committee.

•Firmwide Compliance and Operational Risk Committee. The Firmwide Compliance and Operational Risk Committee is responsible for overseeing compliance and operational risk. This committee is co-chaired by our chief operating officer of Engineering, our head of Operational Risk, and our chief compliance officer, who are appointed as chairs by the chairs of the Firmwide Enterprise Risk Committee.

•Firmwide Risk Appetite Committee. The Firmwide Risk Appetite Committee (through delegated authority from the Firmwide Enterprise Risk Committee) is responsible for the ongoing approval and monitoring of risk frameworks, policies and parameters related to our risk management processes, as well as limits, thresholds and alerts, at firmwide, business and product levels. In addition, this committee is responsible for overseeing our financial and model risks and reviews the results of stress tests and scenario analyses. To assist the Firmwide Risk Appetite Committee in carrying out its mandate, a number of other risk committees with dedicated oversight for stress testing, model risks, Volcker Rule compliance, as well as our investments or other capital commitments that may give rise to financial risk, report into the Firmwide Risk Appetite Committee. This committee is chaired by our chief risk officer, who is appointed as chair by the chairs of the Firmwide Enterprise Risk Committee. The Firmwide Capital Committee and Firmwide Commitments Committee report to the Firmwide Risk Appetite Committee.

•Firmwide Reputational Risk Committee. The Firmwide Reputational Risk Committee is responsible for assessing reputational risks arising from opportunities that have been identified as having potential heightened reputational risk, including transactions identified pursuant to the criteria established by the Firmwide Reputational Risk Committee and as determined by committee leadership. This committee is also responsible for overseeing client-related business standards and addressing client-related reputational risk. This committee is chaired by our president and chief operating officer, who is appointed as chair by our chief executive officer, and the vice-chairs are our chief legal officer and the head of Conflicts Resolution, who are appointed as vice-chairs by the chair of the Firmwide Reputational Risk Committee. The Firmwide Suitability Committee reports to the Firmwide Reputational Risk Committee.

•Firmwide Data Governance Committee. The Firmwide Data Governance Committee is responsible for overseeing the firmwide data governance framework, and its implementation, to help ensure that data governance and data quality are appropriate. This committee is co-chaired by our chief information officer and an advisory director, who are appointed as chairs by the chairs of the Firmwide Enterprise Risk Committee.

Firmwide Asset Liability Committee. The Firmwide Asset Liability Committee is responsible for the strategic direction of our financial resources, including capital, liquidity, funding and balance sheet. This committee has oversight responsibility for asset-liability management, including interest rate and currency risk, funds transfer pricing, capital allocation and incentives, and credit ratings. This committee is co-chaired by our chief financial officer and our global treasurer, who are appointed as chairs by our chief executive officer, and reports to the Management Committee.