Technology Risk Policy – Template 1

The objectives of the Technology Risk Policy are to ensure that Technology Risks are proactively identified, well understood, and prudently managed in order to support the achievement of business objectives and to fully comply with any related regulatory and corporate requirements.

Policy objectives are achieved by:

a. Establishing the board and management governance structure with defined roles, responsibilities and reporting to oversee and effectively review and challenge the identification, assessment and management of Technology Risks within the Company

b. Providing a consistent framework for Technology Risks which defines the Technology Risk appetite and includes an integrated set of processes and tools to identify, assess, manage, measure and report on technology risk

For the purpose of this policy, Technology Risk is defined as the risk associated with the use, ownership, operation, involvement, influence and adoption of information technology. Technology Risk includes risks potentially triggered by technology non-compliance with regulatory obligations, information security and privacy incidents, business disruption, technology internal control and process gaps, technology operational events, and adoption of new business technologies.