PRUDENTIAL FINANCIAL INC

We employ a risk governance structure, overseen by senior management and our Board and managed by Risk Management, to provide a common framework for: evaluating the risks embedded in and across our businesses and corporate centers; developing risk appetites; managing these risks; and identifying current and future risk challenges and opportunities. For a discussion of the risks of our businesses, see “Risk Factors.”

Risk Governance Framework

Prudential uses a Three Lines of Defense model of risk management in which the businesses are the primary, or first line, responsible for understanding, assessing, and taking steps to mitigate and manage risk. Each business has a risk governance structure that is supported by a common framework at the enterprise level.

While having different roles, responsibilities, and scope, Risk Management and Compliance together act as the second line, further strengthening Prudential’s management of risk by providing effective challenge, and oversight of management activities and testing and assessing the effectiveness of first line controls. Risk Management, led by the Chief Risk Officer, oversees these risks under the guidance of the Executive Risk Committee (“ERC”) and Enterprise Risk Management Council (“ERMC”). Additionally, Risk Management works with Prudential’s businesses and corporate centers to identify, monitor and manage risks that Prudential may face.

The Audit Department acts as the third line of defense through monitoring and testing to assure that the other lines of defense (first in the business and second in Risk and Compliance) are well-designed and operating as intended. Processes are optimized across Prudential’s Three Lines of Defense to strengthen how risk management is performed across the Prudential enterprise while continuing to fulfill the individual mandates of each of the three control functions.

Board of Directors Oversight

Our Board oversees our risk profile and management’s processes for assessing and managing risk, through both the whole Board and its committees. The Board also reviews strategic risks and opportunities facing the Company and its businesses. Other important categories of risk are assigned to designated Board committees that report back to the full Board. In general, the committees oversee the following risks:

•Audit Committee: insurance risk, operational risk, and model risk, as well as risks related to financial controls, legal, regulatory, cyber security and compliance risk;

•Compensation and Human Capital Committee: strategy, reputation and risks regarding human capital management throughout our global businesses; and oversee the assessment of the risks related to the Company’s succession planning, compensation policies and programs applicable to officers and employees, including the review of the assessment results;

•Corporate Governance and Business Ethics Committee: the Company’s overall ethical culture, political contributions, lobbying expenses and overall political strategy, as well as the Company’s environmental risk (which includes climate risk), sustainability and corporate social responsibility to minimize reputational risk and focus on future sustainability;

•Finance Committee: liquidity risk, risk involving our capital management, the incurrence and repayment of borrowings, the capital structure of the Company, funding of benefit plans and statutory insurance reserves, oversight of Own Risk and Solvency Assessment (“ORSA”) and the Company’s Risk Appetite Framework. The Finance Committee oversees our capital plan and receives regular updates on the sources and uses of capital relative to plan; and

•Investment Committee: investment risk, market risk, and review of investment performance and risk positions. The Investment Committee approves investment and market risk limits based on asset class, issuer, credit quality and geography.

Management Oversight

Our primary risk management committee is the ERC. The ERC is chaired by our Chief Risk Officer and otherwise consists of the Vice Chairman, Head of U.S. Businesses, Head of International Businesses and PGIM, General Counsel, Chief Financial Officer, Chief Investment Officer, Head of Global Technology and Operations, and Chief Actuary. Our Chief Auditor also attends meetings of the ERC. The ERC oversees the Company’s risk management framework, including the identification, assessment, monitoring and management of risks and how those risks align with the Company’s loss absorption resources. The primary focus of the ERC is the critical analysis of significant quantitative and qualitative risks and the appropriateness and alignment of those risks to the defined risk appetite of the Company.

The ERC is supported by the ERMC, which is also chaired by our Chief Risk Officer and provides a forum for corporate and functional leaders and technical subject matter experts to review and advise decision makers on financial and non-financial risk matters that are of Enterprise significance, providing transparency into the Company’s overall risk profile, assumptions and methodologies used to measure risk exposure and strategies and practices for mitigating risks.

In addition, each of our businesses and corporate centers have forums for leaders to identify, assess, and monitor risk and exposure issues and to review new business activities and initiatives.

Risk Management Oversight

Risk Management manages the risk management framework. The function operates independently and is responsible for recommending policies, limits and standards for all risks. Risk Management oversees these risks under the guidance of the ERC and ERMC. Additionally, Risk Management works with our businesses and corporate areas to identify, monitor and manage risks. The Risk Management infrastructure is generally aligned by risk type (investment, market, liquidity, insurance, model, and operational), with certain groups within Risk Management working across risk types.

Risk Identification

Prudential relies on a combination of activities to ensure that all material risks have been identified and managed as appropriate. The Company conducts risk identification through several processes at the business unit, corporate, senior management, and Board levels to provide a “top-down” and “bottom-up” three-dimensional view of risk. Prudential has developed a comprehensive understanding of the risks to its business, both financial and non-financial, and their interdependencies. A risk can have an impact at the product, business, and enterprise levels, and all these considerations and their range of outcomes through a variety of stresses are the focus of Risk Management as well as the enterprise.

•Business Activities: Each business has a forum that allows senior leaders to discuss and evaluate current, new, and emerging risks in their own operations. Businesses are accountable for identifying and managing top risks through the risk governance structure.

•Corporate Center Activities: The corporate centers review the results of the business activities and examine risks from an enterprise view across businesses under normal and stressed conditions. As a result, the corporate centers, particularly Risk Management, use several processes and activities to identify and assess the risks of the Company. Corporate centers manage key risks and initiatives through existing senior leadership team structures.

•Senior Management and the Board: Senior management plays a critical role in reviewing the risk profile of the Company, including identifying impacts to the business strategy and risks in any new strategies under consideration. These risks are discussed with PFI’s Operating Committee or the ERC as appropriate, and with the Board if significant. As discussed above, the Board oversees the Company’s risk profile and management’s processes for assessing and managing risk, both as a full Board and through its committees.

Risk Measurement and Monitoring

Our Risk Appetite Framework is a comprehensive process designed to reasonably ensure that risks taken across the Company align with the Company’s capacity and willingness to take those risks. Using the Risk Appetite Framework, the Company measures, evaluates, and manages its financial risks. The comprehensive models, metrics, and stress scenarios used enable the Company to understand its current risk profile as well as how the risk profile may change over time through varying degrees of stress. The Risk Appetite Framework anchors the risk and capital management processes and supports management and the Board in making well-informed business decisions..

The Risk Appetite Framework is centered around a comprehensive and cohesive stress testing regime which includes a variety of stress scenarios designed to explore outcomes across businesses. This robust stress testing examines the sensitivity of assets and liabilities and how they interact through time to identify places where the Company’s capacity may be challenged by the risks taken. These analytics provide insight into the impact of stress scenarios on capital and liquidity.

Additionally, the Risk Appetite Framework contains qualitative risk appetite statements that help the Company understand and manage risks that are not easily quantifiable.