Ryerson Holding Corp

Under its charter, the internal audit department is tasked to help the Company accomplish its objectives by bringing a systematic and disciplined approach to evaluate and improve the effectiveness of the Company’s risk management, control and governance processes. To promote independence of the department and ensure appropriate internal audit coverage, the internal audit director is responsible for leading the department and reports functionally to the Audit Committee, and administratively (i.e., day-to-day operations) to the chief financial officer. The internal audit services personnel have unrestricted access to all functions, records, property and personnel of the Company and full and free access to the Audit Committee. The internal audit department is currently staffed entirely by a third-party auditing firm.

The scope of the department’s internal auditing encompasses, but is not limited to, the examination and evaluation of the adequacy and effectiveness of the Company’s governance, risk management and internal controls, as well as the quality of performance in carrying out assigned responsibilities to achieve the Company’s stated goals and objectives. This includes, among other things:

•

partnering with other governance and monitoring groups to evaluate risk exposure relating to achievement of the Company’s strategic objectives;

•

monitoring and evaluating the effectiveness of the Company’s risk management processes;

•

performing consulting and advisory services related to governance, risk management and control as appropriate for the Company; and

•

reporting significant risk exposures and control issues, including fraud risks, governance issues, cybersecurity risks and other matters needed or requested by the Audit Committee.

The internal audit department provides reports on these items to the Audit Committee at each regularly scheduled Audit Committee meeting. In addition, the internal audit department is responsible for conducting an annual risk assessment. In performing this risk assessment, the internal audit department distributes a risk assessment survey to management across the Company. The survey poses open-ended questions relating to risks and opportunities facing the Company as well as asks management to rank different risk areas based on impact (requiring management to consider how significant the risk or opportunity is to the Company) and vulnerability (requiring management to consider how prepared Ryerson is to address the risk or take full advantage of the opportunity). Following its assessment, the internal audit department, subject to the Audit Committee's oversight, is responsible for and developing a corresponding annual audit plan using a risk-based approach to monitor and report on the adequacy and effectiveness of the Company’s processes for controlling its activities and managing its risks.