Year 1 ERM TIMELINE Determination to build ERM

Year 1 ERM TIMELINE Determination to build ERM program Assign accountable leaders to risks ERM Executives meet with accountable leaders to develop mitigation tactics for high priority risks Appoint leader(s) to spearhead ERM (“ERM Executives”) Solicit senior leadership (1 st level management) input into risks; assign risk ratings (prioritize risks) Accountable leaders (and their teams) implement risk mitigation tactics Consult ERM resources Identify risks across the organization that could jeopardize achievement of the organization’s strategic plan (or goals) • ERM Executives provide progress update to 1 st level management • ERM Executives provide progress update to Board/Board committee

Year 2 ERM TIMELINE Solicit 2 nd level management input into risks via online survey and dedicated ERM email address Accountable leaders (and their teams) implement risk mitigation tactics Implement survey results External assessment of ERM program; enhance ERM program in line with external assessment ERM Executives provide progress update to 1 st level management Identify Board/Board committee oversight of ERM program ERM Executives meet with accountable leaders to update progress on mitigation tactics for high priority risks, identify new risks ERM Executives provide progress update to Board/Board committee

Year 3 ERM TIMELINE Create, publish ERM policy Accountable leaders (and their teams) implement risk mitigation tactics ERM Executives provide progress update to 1 st level management Educate 2 nd level management about ERM program, provide tools for management to communicate with and educate staff (e. g. , message map, talking points, examples) ERM Executives send communication to all team members across the organization advising on progress and next steps ERM Executives review organization’s updated strategic plan (or goals) to ensure that risks that could jeopardize achievement of the strategic plan (or goals) are included in ERM; ERM Executives meet with accountable leaders to develop mitigation tactics for updated high priority risks ERM Executives provide progress update to Board/Board Committee

Years 4&5 ERM TIMELIN E ERM Executives identify Top 10 ERM risks, obtain 1 st and 2 nd level management input Obtain 1 st level management input into COVID-19 risk mitigation tactics Provide progress update with focus on COVID-19 to Board/Board committee NOTE: Operational-level ERM program focused on business level risks runs separately and in line with enterprise-level strategic ERM program ERM Executives provide progress update and Top 10 ERM risks to Board/Board Committee Update ERM pandemic risk category to include COVID-19 ERM Executives meet with accountable leaders to update progress on mitigation tactics for high priority risks, identify new risks