Board Risk Committee Terms of Reference

Date of approval	February 2026
Role	The Risk Committee is a committee of the Society’s Board which is responsible for the oversight of risk management and the risk profile of the Society It’s primary objectives are: To promote a robust Risk culture, ensuring risk awareness is integrated into decision making at all levels taking account of the objectives of the Society, and the regulatory and statutory requirements that prevail.’ To oversee implementation and embedding of the Enterprise Risk Management Framework (ERMF), including management’s response to breaches of risk appetite as detailed in the ERMF. To review and approve key risk policies and frameworks.
Membership	The Committee shall comprise at least three members. Members of the Committee are appointed by the Board, upon the recommendation of the Governance & Nominations Committee and in consultation with the Chair of the Risk Committee.
Chair	The Chair of the Committee shall be appointed by the Board. In the absence of the Committee Chair at a Committee meeting, the remaining members present shall elect one of themselves to chair the meeting.
Secretary	The Secretary of the meeting will be agreed between the Chair of the Meeting and the Society Secretary.
Attendees	Only members of the Committee have the right to attend Committee meetings. However, other individuals may be invited to attend for all or part of the meeting, as and when appropriate.
Frequency	The Committee shall meets a minimum of four times per annum.
Quorum	Three members.
Written resolutions	Written resolutions may be used in accordance with the Society’s Rules.
Meeting papers and minutes	The Secretary of the Committee shall circulate the Agenda and papers for each meeting of the Committee no less than five working days in advance of the relevant meeting. Minutes will record the proceedings, resolutions and decisions including recording the names of those present and in attendance and record any declarations of interest/conflicts of interest disclosed at meetings. The minutes of the meeting shall be approved at the next meeting.
Mandate	The Committee is authorised to perform such other oversight functions as the Board may request.
Reports to	This Committee reports to the Society’s Board.
Sub Committees	None.

Responsibilities

Purpose	Matter	Frequency
1.1 Oversight	Ensure the Enterprise Risk Management Framework is consistent with the risk strategy and appetite of the Society and oversee the embedding through reporting and escalation. Receive reports on the current and emerging risks to review and challenge with particular focus on metrics which are reporting outside of risk appetite position (if any) and where appropriate to ensure that the appropriate actions are taken in a timely fashion taking into account the potential reputational risk, customer harm and/or risk of non-compliance.	As necessary
1.2 Recommend for Board approval / Approve	Review Level 1 and Level 2 measures and approve or recommend for approval as appropriate.	At least annually
1.3 Monitor	Consider the impact on the Society’s risk profile of any business project in line with the delegated authorities and judgement of materiality from the CRO/CTO and make appropriate recommendations to the Board.	As necessary
1.4 Approve	Approve any changes to the Society’s IRB models. Receive confirmation that the Society’s IRB models have been reviewed by the Internal Audit function (or another comparable independent auditing unit) , including the operations of the credit function and the estimation of PDs, LGDs, Els and conversion factors (Areas of review shall include adherence to all applicable statutory or regulatory requirements) and following confirmation consider re approval.	As necessary At least annually
1.5 Approve	Approve the detailed gap analysis and the associated remediation plan against SS1/23 requirements.	As necessary
1.6 Oversight	Ensure that Customer outcomes are a central focus of risk and internal audit processes through updates from the ERC, with particular regard to Consumer Duty – Principle 12.	Ongoing
1.7 Oversight	Receive reports on the actions being taken to identify and mitigate the financial risks of climate change.	At least annually
1.8 Oversight	Receive reports on the actions being taken to identify and mitigate the risks associated with financial crime, fraud, facilitation of tax evasion and bribery and corruption.	At least annually
1.9 Recommend for Board approval / Approve	Review and approve key risk policies and frameworks: Retail Lending Policy (Approve) Commercial Lending Policy (Approve) Treasury Policy Statement (Recommend) Operational Resilience attestation (Approve) Consumer Duty attestation (Recommend) Model Risk Policy (Approve)	At least annually
1.10 Approve	Review and approve (where appropriate) key risk policies and frameworks, including: Enterprise Risk Management Framework Bribery & Conflicts of Interest Policy Compliance & Conduct Policy Financial Crime Policy	Triennially
1.11 Recommend	Review, challenge and approve financial and economic assumptions, stress and reverse stress scenarios used within the ICAAP and ILAAP. Recommend the ICAAP and ILAAP to the Board for approval.	As necessary
1.12 Oversight	Monitor the independence and objectivity of the 2nd line Risk Function and satisfy itself that the resources available to that function are adequate.	At least annually
1.13 Oversight	Provide reports and recommendations to the Remuneration Committee in respect of the attainment of risk related ‘gateway’ thresholds in relation to variable pay awards and overall performance of individuals.	As appropriate
1.14 Recommend	Review its own performance, constitution and terms of reference to ensure it is operating at maximum effectiveness and recommend any changes it considers necessary to the Board for approval.	At least annually
1.15 Approve	Review and approve the terms of reference for the ERC and MGC.	At least Biennially
1.16 Review	Review the overall levels of insurance for the Society including Directors and Officers Liability Insurance and make recommendations to the Board.	At least Annually BRC review policies in light of view on risk. Board should approve based on listening.
1.17 Approve	Approval of any material changes to the allocation of responsibilities as set out in the Society’s Responsibility Map.	As necessary
1.18 Recommend	Recommend for approval the statements to be included in the Statutory Reports concerning the role and responsibilities of the Committee and the action it has taken to discharge those responsibilities.	As necessary
1.19 Review	Determine appropriate training and development for Committee Members both on appointment and on an ongoing basis to ensure that Members of the Committee are appropriately skilled.	As necessary