ROYAL GOLD INC

To identify and assess material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity threat risks alongside other Company risks as part of our overall risk assessment process. We describe how risks from identified cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our results of operations and financial condition, in the risk factor entitled “A significant disruption to our information technology systems or those of our third-party service providers could adversely affect our business and operating results” under Item 1A, Risk Factors, of this report.

The Senior Vice President and Chief Financial Officer, with assistance from other members of management and contracted information technology and cybersecurity consultants (including consultants with decades of experience in information technology and cybersecurity roles), is responsible for managing our cybersecurity program, policies and strategy. Under its Charter, the Audit and Finance Committee (“AFC”) of our Board of Directors is responsible for oversight of our cybersecurity program. Quarterly and annual reports are provided to our AFC and Board of Directors, respectively, on the cyber risks, threats and projects impacting our cybersecurity program. As part of our continuing effort to evaluate and enhance our cybersecurity program, including risks associated with using third-party service providers, we regularly evaluate the effectiveness of our cybersecurity policies and procedures and provide our employees with cybersecurity training on current and evolving cybersecurity threats.