GOLDMAN SACHS GROUP INC

We believe that effective risk management is critical to our success. Accordingly, we have established an enterprise risk management framework that employs a comprehensive, integrated approach to risk management and is designed to enable comprehensive risk management processes through which we identify, assess, monitor and manage the risks we assume in conducting our activities. Our risk management structure is built around three core components: governance, processes and people.

Governance. Risk management governance starts with the Board, which both directly and through its committees, including its Risk Committee, oversees our risk management policies and practices implemented through the enterprise risk management framework. The Board is also responsible for the annual review and approval of our risk appetite statement. The risk appetite statement describes the levels and types of risk we are willing to accept or to avoid in order to achieve our objectives included in our strategic business plan, while remaining in compliance with regulatory requirements. The Board reviews our strategic business plan and is ultimately responsible for overseeing and providing direction about our strategy and risk appetite.

The Board, including through its committees, receives regular briefings on firmwide risks, including liquidity risk, market risk, credit risk, operational risk, cybersecurity risk, model risk and climate risk, from our independent risk oversight and control functions, including our chief risk officer, on cybersecurity threats and risks from our chief information security officer (CISO), on compliance risk and conduct risk from our chief compliance officer, on legal and regulatory enforcement matters from our chief legal officer, and on other matters impacting our reputation from the chair and/or vice-chairs of our Firmwide Reputational Risk Committee. The chief risk officer reports to our chief executive officer and to the Risk Committee of the Board. As part of the review of the firmwide risk portfolio, the chief risk officer regularly advises the Risk Committee of the Board of relevant risk metrics and material exposures, including risk limits and thresholds established in our risk appetite statement.

The implementation of our risk governance structure and core risk management processes is overseen by Enterprise Risk, which reports to our chief risk officer, and is responsible for ensuring that our enterprise risk management framework provides the Board, our risk committees and senior management with a consistent and integrated approach to managing our various risks in a manner consistent with our risk appetite.

Our revenue-producing units, as well as Treasury, Engineering, Human Capital Management, Operations, and Corporate and Workplace Solutions, are considered our first line of defense. They are accountable for the outcomes of our risk-generating activities, as well as for assessing and managing those risks within our risk appetite.

Our independent risk oversight and control functions are considered our second line of defense and provide independent assessment, oversight and challenge of the risks taken by our first line of defense, as well as lead and participate in risk committees. Independent risk oversight and control functions include Compliance, Conflicts Resolution, Controllers, Legal, Risk and Tax.

Internal Audit is considered our third line of defense, and our director of Internal Audit reports to the Audit Committee of the Board and administratively to our chief executive officer. Internal Audit includes professionals with a broad range of audit and industry experience, including risk management expertise. Internal Audit is responsible for independently assessing and validating the effectiveness of key controls, including those within the risk management framework, and providing timely reporting to the Audit Committee of the Board, senior management and regulators.

The three lines of defense structure promotes the accountability of first line risk takers, provides a framework for effective challenge by the second line and empowers independent review from the third line.

Processes. We maintain various processes that are critical components of our risk management framework, including (i) risk identification and control assessment, (ii) risk appetite, limits, thresholds and alerts setting, (iii) risk metrics, reporting and monitoring, and (iv) risk decision-making.

•Risk Identification and Control Assessment. We believe the identification of our risks and related control assessment is a critical step in providing our Board and senior management transparency and insight into the range and materiality of our risks. We have a comprehensive data collection process, including firmwide policies and procedures that require all employees to report and escalate risk events. Our approach for risk identification and control assessment is comprehensive across all risk types, is dynamic and forward-looking to reflect and adapt to our changing risk profile and business environment, leverages subject matter expertise, and allows for prioritization of our most critical risks. This approach also encompasses our control assessment, led by our second line of defense, to review and challenge the control environment to help ensure it supports our strategic business plan.

To effectively assess our risks, we maintain a daily discipline of marking substantially all of our inventory to current market levels. We carry our inventory at fair value, with changes in valuation reflected immediately in our risk management systems and in net revenues. We do so because we believe this discipline is one of the most effective tools for assessing and managing risk and that it provides transparent and realistic insight into our inventory exposures.

An important part of our risk management process is firmwide stress testing. It allows us to quantify our exposure to tail risks, highlight potential loss concentrations, undertake risk/reward analysis, and assess and mitigate our risk positions. Firmwide stress tests are performed on a regular basis and are designed to ensure a comprehensive analysis of our vulnerabilities and idiosyncratic risks combining financial and nonfinancial risks, including, but not limited to, credit, market, liquidity and funding, operational and compliance, climate, strategic, systemic and emerging risks into a single combined scenario. We also perform ad hoc stress tests in anticipation of market events or conditions. Stress tests are also used to assess capital adequacy as part of our capital planning and stress testing process. See “Capital Management and Regulatory Capital — Capital Management” for further information.

•Risk Appetite, Limits, Thresholds and Alerts Setting. We apply a framework of limits and thresholds to control and monitor risk across transactions, products, businesses and markets. The Board, directly or indirectly through its Risk Committee, approves limits, thresholds and alerts included in our risk appetite statement at firmwide, business and product levels. In addition, the Firmwide Risk Appetite Committee, through delegated authority from the Firmwide Enterprise Risk Committee, is responsible for approving our risk limits, thresholds and alerts policy, subject to the overall limits approved by the Risk Committee of the Board, and monitoring these limits.

The Firmwide Risk Appetite Committee is responsible for approving limits at firmwide, business and product levels. Certain limits may be set at levels that will require periodic adjustment, rather than at levels that reflect our maximum risk appetite. This fosters an ongoing dialogue about risk among our first and second lines of defense, committees and senior management, as well as rapid escalation of risk-related matters. Additionally, through delegated authority from the Firmwide Risk Appetite Committee, Market Risk sets limits at certain product and desk levels, and Credit Risk sets limits for individual counterparties and their subsidiaries, industries and countries. Limits are reviewed regularly and amended on a permanent or temporary basis to reflect changes to our strategic business plan, as well as changing market conditions, business conditions or risk tolerance.

•Risk Metrics, Reporting and Monitoring. Effective risk reporting and risk decision-making depends on our ability to get the right information to the right people at the right time. As such, we focus on the rigor and effectiveness of our risk systems, with the objective of ensuring that our risk management technology systems provide us with complete, accurate and timely information. Our risk metrics, reporting and monitoring processes are designed to take into account information about both existing and emerging risks, thereby enabling our risk committees and senior management to perform their responsibilities with the appropriate level of insight into risk exposures. Furthermore, our limit and threshold breach processes provide means for timely escalation. We evaluate changes in our risk profile and our businesses, including changes in business mix or jurisdictions in which we operate, by monitoring risk factors at a firmwide level.

•Risk Decision-Making. Our governance structure provides the protocol and responsibility for decision-making on risk management issues and is designed to ensure implementation of those decisions. We make extensive use of risk committees that meet regularly and serve as an important means to facilitate and foster ongoing discussions to manage and mitigate risks.

We maintain strong and proactive communication about risk and we have a culture of collaboration in decision-making among our first and second lines of defense, committees and senior management. While our first line of defense is responsible for management of their risk, we dedicate extensive resources to our second line of defense in order to ensure a strong oversight structure and an appropriate segregation of duties. We regularly reinforce our strong culture of escalation and accountability across all functions.

People. Even the best technology serves only as a tool for helping to make informed decisions in real time about the risks we are taking. Ultimately, effective risk management requires our people to interpret our risk data on an ongoing and timely basis and adjust risk positions accordingly. The experience of our professionals, and their understanding of the nuances and limitations of each risk measure, guides us in assessing exposures and maintaining them within prudent levels.

We reinforce a culture of effective risk management, consistent with our risk appetite, in our training and development programs, as well as in the way we evaluate performance, and recognize and reward our people. Our training and development programs, including certain sessions led by our most senior leaders, are focused on the importance of risk management, client relationships and reputational excellence. As part of our performance review process, we assess reputational excellence, including how an employee exercises good risk management and reputational judgment, and adheres to our code of conduct and compliance policies. Our review and reward processes are designed to communicate and reinforce to our professionals the link between behavior and how people are recognized, the need to focus on our clients and our reputation, and the need to always act in accordance with our highest standards.

Structure

Ultimate oversight of risk is the responsibility of our Board. The Board oversees risk both directly and through its committees, including its Risk Committee. We also have a series of committees that generally consist of senior managers from both our first and second lines of defense, with specific risk management mandates that have oversight or decision-making responsibilities for risk management activities. We have established procedures for these committees so that appropriate information barriers are in place. Our primary risk committees, most of which also have additional sub-committees, councils or working groups, are described below. In addition to these committees, we have other risk committees that provide oversight for different businesses, activities, products, regions and entities. All of our committees have responsibility for considering the impact on our reputation of the transactions and activities that they oversee.

Membership of our risk committees is reviewed regularly and updated to reflect changes in the responsibilities of the committee members. Accordingly, the length of time that members serve on the respective committees varies as determined by the committee chairs and based on the responsibilities of the members.

The chart below presents an overview of our risk management governance structure.

Management Committee. The Management Committee oversees our global activities. It provides this oversight directly and through authority delegated to committees it has established. This committee consists of our most senior leaders, and is chaired by our chief executive officer. Most members of the Management Committee are also members of other committees. The following are the committees that are principally involved in firmwide risk management.

Firmwide Enterprise Risk Committee. The Firmwide Enterprise Risk Committee is responsible for overseeing all of our financial and nonfinancial risks. As part of such oversight, the committee is responsible for the ongoing review, approval and monitoring of our enterprise risk management framework, as well as our risk limits, and thresholds and alerts policy, through delegated authority to the Firmwide Risk Appetite Committee. The Firmwide Enterprise Risk Committee also reviews new significant strategic business initiatives to determine whether they are consistent with our risk appetite and risk management capabilities. Additionally, the Firmwide Enterprise Risk Committee performs enhanced reviews of significant risk events, the top residual and emerging risks, and the overall risk and control environment in each of our business units in order to propose uplifts, identify elements that are common to all business units and analyze the consolidated residual risks that we face. This committee, which reports to the Management Committee, is co-chaired by our president and chief operating officer and our chief risk officer, who are appointed as chairs by our chief executive officer, and the vice-chair is our chief financial officer, who is appointed as vice-chair by the chairs of the Firmwide Enterprise Risk Committee. The Firmwide Enterprise Risk Committee also periodically provides updates to, and receives guidance from, the Risk Committee of the Board. The following are the primary committees or councils that report to the Firmwide Enterprise Risk Committee (unless otherwise noted):

•Firmwide Risk Council. The Firmwide Risk Council is responsible for the ongoing monitoring of relevant financial risks at the firmwide, business and product levels. This council is co-chaired by our chief financial officer and our chief risk officer.

•Firmwide New Activity Committee. The Firmwide New Activity Committee is responsible for reviewing new activities and for establishing a process to identify and review previously approved activities that are significant and that have changed in complexity and/or structure or present different reputational and suitability concerns over time to consider whether these activities remain appropriate. This committee is chaired by our controller and chief accounting officer, who is appointed as chair by the chairs of the Firmwide Enterprise Risk Committee.

•Firmwide Operational Risk and Resilience Committee. The Firmwide Operational Risk and Resilience Committee is responsible for overseeing operational risk, and seeks to ensure our business and operational resilience. To assist the Firmwide Operational Risk and Resilience Committee in carrying out its mandate, other risk committees with dedicated oversight for technology-related risks, including cybersecurity matters and artificial intelligence (AI), report into the Firmwide Operational Risk and Resilience Committee. This committee is co-chaired by our chief administrative officer for EMEA and our head of Operational Risk, who are appointed as chairs by the chairs of the Firmwide Enterprise Risk Committee.

•Firmwide Conduct Committee. The Firmwide Conduct Committee is responsible for the ongoing approval and monitoring of the frameworks and policies which govern our conduct risks. Conduct risk is the risk that our people fail to act in a manner consistent with our Business Principles and related core values, policies or codes, or applicable laws or regulations, thereby falling short in fulfilling their responsibilities to us, our clients, colleagues, other market participants or the broader community. This committee is chaired by our chief legal officer, who is appointed as chair by the chairs of the Firmwide Enterprise Risk Committee.

•Firmwide Risk Appetite Committee. The Firmwide Risk Appetite Committee (through delegated authority from the Firmwide Enterprise Risk Committee) is responsible for the ongoing approval and monitoring of risk frameworks, policies and parameters related to our core risk management processes, as well as limits, thresholds and alerts, at firmwide, business and product levels. In addition, this committee is responsible for overseeing our financial risks and reviews the results of stress tests and scenario analyses. To assist the Firmwide Risk Appetite Committee in carrying out its mandate, a number of other risk committees with dedicated oversight for stress testing, model risks, Volcker Rule compliance, as well as our investments or other capital commitments that may give rise to financial risk, report into the Firmwide Risk Appetite Committee. This committee is chaired by our chief risk officer, who is appointed as chair by the chairs of the Firmwide Enterprise Risk Committee. The Firmwide Capital Committee and Firmwide Commitments Committee report to the Firmwide Risk Appetite Committee.

Firmwide Capital Comm ittee. The Firmwide Capital Committee provides approval and oversight of debt-related transactions, including principal commitments of our capital. This committee aims to ensure that business, reputational and suitability standards for underwritings and capital commitments are maintained on a global basis. This committee is co-chaired by our head of Credit Risk and a co-head of our Global Financing Group, who are appointed as chairs by the chair of the Firmwide Risk Appetite Committee.

Firmwide Commitments Committee. The Firmwide Commitments Committee reviews our underwriting and distribution activities with respect to equity and equity-related product offerings, and sets and maintains policies and procedures designed to ensure that legal, reputational, regulatory and business standards are maintained on a global basis. In addition to reviewing specific transactions, this committee periodically conducts general strategic reviews of sectors and products and establishes policies in connection with transaction practices. This committee is co-chaired by our chief equity underwriting officer for the Americas, a co-chairman of our Global Financial Institutions Group, and a co-head of our Global Investment Grade Capital Markets and Risk Management Group in Global Banking & Markets, who are appointed as chairs by the chair of the Firmwide Risk Appetite Committee.

•Firmwide Reputational Risk Committee. The Firmwide Reputational Risk Committee is responsible for assessing reputational risks arising from opportunities that have been identified as having potential heightened reputational risk, including transactions identified pursuant to the criteria established by the Firmwide Reputational Risk Committee and as determined by committee leadership. This committee is also responsible for overseeing client-related business standards and addressing client-related reputational risk. This committee is chaired by our president and chief operating officer, who is appointed as chair by our chief executive officer, and the vice-chairs are our chief legal officer and the head of Conflicts Resolution, who are appointed as vice-chairs by the chair of the Firmwide Reputational Risk Committee. This committee periodically provides updates to, and receives guidance from, the Public Responsibilities Committee of the Board. The Firmwide Suitability Committee reports to the Firmwide Reputational Risk Committee.

Firmwide Suitability Committee. The Firmwide Suitability Committee is responsible for setting standards and policies for product, transaction and client suitability and providing a forum for consistency across functions, regions and products on suitability assessments. This committee also reviews suitability matters escalated from other committees. This committee is co-chaired by our chief compliance officer and an advisory director, who are appointed as chairs by the chair of the Firmwide Reputational Risk Committee.

•Firmwide Data Governance Committee. The Firmwide Data Governance Committee is responsible for overseeing the firmwide data governance framework, and its implementation, to help ensure that data governance and data quality are appropriate. This committee is co-chaired by our chief information officer and our chief risk officer, who are appointed as chairs by the chairs of the Firmwide Enterprise Risk Committee.

Firmwide Asset Liability Committee. The Firmwide Asset Liability Committee reviews and approves the strategic direction for our financial resources, including capital, liquidity, funding and balance sheet. This committee has oversight responsibility for asset liability management, including interest rate and currency risk, funds transfer pricing, capital allocation and incentives, and credit ratings. This committee makes recommendations as to any adjustments to asset liability management and financial resource allocation in light of current events, risks, exposures, and regulatory requirements and approves related policies. This committee is co-chaired by our chief financial officer and our global treasurer, who are appointed as chairs by our chief executive officer, and reports to the Management Committee.