KEYCORP /NEW/

Like all financial services companies, we engage in business activities that come with related risks. The most significant risks we face are credit, compliance, operational, liquidity, market, strategic, model, and technology risks, as depicted in the following chart. We manage such risks across the entire enterprise to maintain safety and soundness and maximize profitable growth. Certain of these risks are defined and discussed in greater detail in the remainder of this section.

Our risk appetite is defined as the level of risk we are willing to accept and prudently manage in pursuit of our strategic objectives. It is consistent with our pursuit of risk-adjusted shareholder returns, our corporate risk-taking capacity and willingness to accept risk. Our risk appetite statement is an important component of our enterprise risk governance framework, reinforces our risk culture, and provides focus on our primary risk management tenets of soundness, profitability, and growth.

Our risk appetite framework serves as a guide for establishing corporate and business strategies as well as for developing and evaluating strategic objectives and capital planning activities. It is articulated through qualitative statements and quantitative metrics, approved by the Board of Directors, and translated into limits, targets, and other measures at appropriate levels in the organization.

Maintaining a strong risk culture plays an integral role in achieving our strategic objectives and delivering for our stakeholders. Each employee plays a proactive role by complying with applicable laws and regulations, treating our customers fairly and responsibly, and demonstrating the highest levels of professionalism, conduct, and ethics. Our risk culture is centered on maintaining strong practices for risk awareness, identification, escalation, and mitigation across the enterprise.

We seek to sustain strong enterprise risk management practices consistent with industry standards and regulatory expectations. The table below depicts our risk management hierarchy and associated responsibilities and activities of each group.

(a) Certain Board Committees, including the Audit and Risk Committees, meet jointly, as appropriate, to discuss matters that relate to each committee’s responsibilities. Committee chairpersons routinely meet with management during interim months to plan agendas for upcoming meetings and to discuss emerging trends and events that have transpired since the preceding meeting. All members of the Board receive formal reports designed to keep them abreast of significant developments during the interim months.

We utilize a Three Lines of Defense model for risk governance which establishes roles and responsibilities for each of the Three Lines, consisting of Business and Support Areas, Risk Management, and Internal Audit relative to the management and oversight of risk. As the first line of defense, Lines of Business and Support Areas have the primary responsibility to accept, own, and proactively identify, monitor, and manage risk. The second line of defense, Risk Management, provides independent, centralized oversight over all risk categories by aggregating, analyzing, and reporting risk information. The third line of defense, Internal Audit, is responsible for independently evaluating the appropriateness of the risk governance framework for the size, complexity, and risk profile of Key.