CWB-Management Proxy Circular-2023-EN

POLICIES REGARDING DIVERSITY IN EXECUTIVE COMMITTEE POSITIONS

Our Corporate Governance Policy requires the Board, when appointing any member of the Executive Committee, to consider, among other things, diversity criteria such as race, ethnicity, age, gender identity, sexual orientation and abilities. Understanding that systemic biases exist broadly across society and our industry, the Board considers the impact of biases to obtain specific qualifications or experiences. The Board set a target to have women comprise at least 30% of the Executive Committee. The Board also set a target to have Black, Indigenous and racialized people comprise at least 5% of the Executive Committee by 2025. Currently two of eight members (25%) of the Executive Committee are women, and two of eight members (25%) of the Executive Committee identify as Black, Indigenous or racialized persons.

RISK MANAGEMENT

Risk management oversight is embedded in our Board and committee structures, and governed through a hierarchy of Board and management committees and individual responsibilities as outlined in the diagram below.

With increasing reliance on technology, management of cyber risk and data protection continues to be an important part of the Board’s mandate. Our Board receives quarterly reports on cybersecurity and is immediately notified if any incident occurs. Additionally, CWB’s Executive Risk Committee has developed and implemented a CyberSecurity Risk Management Standard (CSRMS), which adopts the National Institute of Standards and Technology’s CyberSecuri ty Framework, to guide and establish strategic governance practices in managing cyber risk. The CSRMS ensures alignment with our Enterprise Risk Management and Operational Risk Policies, which establish the principles that make up CWB’s enterprise - wide approach to cybersecurity. The CSRMS is structured around CWB’s Three Lines of Defence framework, with our lines of business and Chief Information Security Office acting as the first line of defence; Operational Risk Management acting as the second line of defence; and Internal Audit acting as the third line of defence. Through our approach to cybersecurity, we aim to balance the benefits of technology with the potential consequences of threat events to create an effective cybersecurity program.

For more details regarding CWB’s approach to risk management, including a report on principal risks that CWB’s operations are exposed to, please refer to the 2022 MD&A available in the Investor Relations section of CWB’s website at www.cwb.com/investor-relations/financial-information/annual-report-and-annual-meeting. It has also been filed, and is available, on SEDAR at www.sedar.com.

25 | Canadian Western Bank- Management Proxy Circular

Powered by