W. P. Carey Inc.

experts including auditors, law firms, cybersecurity experts and third-party consultants to anticipate future threats and trends and re-assess our risk environment periodically to ensure that we are adequately addressing risks.

Our risk oversight process builds upon Management's risk assessment and mitigation processes, which includes the ERM program, a code of conduct that applies to all employees, executives and directors, and comprehensive internal controls. Our CEO, other executive officers and other members of our Management team regularly report to the Board and its committees to discuss short-term, intermediate-term and long-term strategic, operational, emerging, compliance, financial, legal, cybersecurity or regulatory risks, to ensure effective and efficient oversight of our activities and to assist in proper risk management and the ongoing evaluation of management controls. At least once a year Management makes a formal presentation to the entire Board that describes significant risks to us, apprises the Board of our overall risk profile and helps ensure that such risks are being properly mitigated and managed.

Elements of risk management are also performed by various Board committees. For example, the Audit Committee meets with Management, its internal audit group, and PricewaterhouseCoopers LLP, our independent registered public accounting firm, to review risk controls in place. The Audit Committee also receives updates on cybersecurity on a quarterly basis and meets with the Chief Ethics Officer and Chief Legal Officer to review compliance policies and procedures and other compliance issues. While we do not have a Chief Compliance Officer, our Chief Ethics Officer reports directly to the CEO and has primary authority and responsibility for the administration of our Code of Business Conduct and Ethics subject to the oversight of the Nominating and Corporate Governance Committee. The Compensation Committee reviews the risks related to our compensation policies and practices and assesses the impact to our risk profile, at least annually. Management, with the Compensation Committee, regularly reviews our compensation programs, including incentives that may create and factors that may reduce, the likelihood of excessive risk taking in order to determine whether such programs present a significant risk to us. We also have an Investment Committee that assists us in managing investment risk. Additionally, we have established a risk appetite statement which articulates our philosophy and approach to managing its key risks and provides a common framework and a comparable set of measures for Management and the Board to clearly indicate the level of risk we are willing to accept in the pursuit of business objectives. Risk appetite is aligned to our strategy and allows us to be decisive in pursuing opportunities, while ensuring we are not exposed to excessive risk.

We believe that the leadership structure of our Board provides appropriate risk oversight of our activities.