Shake Shack Inc.

​

​

Our Compensation Committee currently consists of Sumaiya Balbale, Charles Chapman III, Jeff Flug, and Lori George, with Ms. Balbale serving as chair. As required by New York Stock Exchange rules, each of Messrs. Chapman and Flug and Mses. Balbale and George meets the definition of “independent director” for purposes of serving on a compensation committee.

Risk Oversight

Our Board of Directors is responsible for overseeing our risk management process. Our Board of Directors focuses on our general risk management strategy and the most significant risks facing us, and oversees the implementation of risk mitigation strategies by management. Our Board of Directors is also apprised of particular risk management matters in connection with its general oversight and approval of corporate matters and significant transactions.

Our Board of Directors does not have a standing risk management committee, but rather we administer this oversight function directly through our Board of Directors as a whole. In particular, our Board of Directors is responsible for monitoring and assessing strategic risk exposure, our Audit Committee is responsible for overseeing our major financial risk exposures and the steps our management has taken to monitor and control these exposures, our Nominating and Corporate Governance Committee is responsible for the oversight of risks associated with our strategies, policies and practices relating to corporate governance, sustainability and social responsibility matters, and our Compensation Committee assesses and monitors whether any of our compensation policies and programs has the potential to encourage unnecessary risk-taking. Our Audit Committee also oversees the performance of our internal audit function and considers and approves or disapproves any related-party transactions. Additionally, our Audit Committee oversees cybersecurity risk as part of its responsibilities for the Company’s risk management approach and structure. The Audit Committee receives quarterly reports from management, including the Director of Information Security who is responsible for leading our governance on information security. The Audit Committee then reports to the Board regarding its activities related to cybersecurity, data privacy and other information technology risks.

In addition, our management has created a Risk Management Oversight Committee, which is responsible for monitoring the Company’s risk environment and providing direction for the activities that are anticipated to mitigate, to an acceptable level, the risks that may adversely affect the Company’s ability to achieve its goals. The Risk Management Oversight Committee facilitates and monitors the implementation of effective risk mitigation steps taken by all Company leaders and assists risk owners in defining target risk exposure and reporting adequate risk-related information throughout the Company. This oversight includes identifying, evaluating, and addressing potential risks that may exist at the enterprise, strategic, financial, operational, compliance and reporting levels. We have also established a business use policy for artificial intelligence to safeguard the Company and enhance our systems.

Risk Considerations in our Compensation Program

We conducted an assessment of our compensation policies and practices for our employees and concluded that these policies and practices are not reasonably likely to have a material adverse effect on the Company. The Company’s compensation program and policies mitigate risk by combining performance-based, long-term compensation elements with payouts that are highly correlated to the value delivered to stockholders. The combination of performance measures for annual bonuses and the equity compensation programs for executive officers, as well as the multi-year vesting schedules for equity awards, encourage employees to maintain both a short- and long-term view with respect to Company performance.

Code of Ethics

We have adopted a written Code of Business Conduct and Ethics that applies to our directors, officers and employees, including our principal executive officer, principal financial officer, principal accounting officer or controller, or persons performing similar functions. We have posted a current copy

15​