Purpose The Risk Committee (the Committee ) is a concurrent committee of the Boards of Concentra Financial Services Associate and Concentra Trust (the Company ). The role of the Committee is to assist the Board of Directors of the Company in fulfilling its oversight responsibilities for the Company s: identification and management of risk; adherence to risk appetite and corporate policy; oversight of integrated enterprise risk management and management control frameworks including balance sheet policy, risk tolerances and stress testing; compliance with risk-related regulatory requirements; and the Risk Oversight function. Authority The authority of the Committee is derived from the Co-operative Credit Associations Act, the Trust and Loan Companies Act, the bylaws of Concentra Financial Services Association and Concentra Trust and their respective Boards of Directors. Structure 1. Composition The Committee shall consist of not less than three directors elected annually by and from the Board of Directors. Not more than fifty percent (50%) of directors constituting the Committee shall be directors representing the same governance region. 2. Appointment and Removal of Committee Members Each member of the Risk Committee shall be appointed by the Board of Directors on an annual basis and shall serve in accordance with this mandate and that of the Board of Directors, or until the earlier of: (a) the close of the next Annual General Meeting at which the member s term of office expires; (b) the death of the member; or
(c) the resignation, disqualification or removal of the member from the Risk Committee or from the Board of Directors. The Board of Directors may fill a vacancy in the membership of the Risk Committee. 3. Competencies Members of the Committee shall have an understanding of issues related to risk management or related business experience, specifically expertise in risk management in the financial industry, with prior experience assessing and managing risks and engaging in strategic thinking relative to the types and complexity of risk in a relevant financial organization. At least one Committee member shall have the risk management expertise as defined in the Competency Matrix at a level four or five. 4. Independence The majority of the Committee shall be independent as defined in the Board Independence Standard 1. 5. Chair The Chair of the Committee shall be elected annually by the members of the Board of Directors effective after each Annual General Meeting or between Annual General Meetings upon the resignation, death, disqualification or removal of the Chair. The Chair shall: (a) be a member of the Committee; (b) preside over all meetings that he or she attends, and in the absence of the Chair, the members of the Committee present shall appoint a Chair from their number for a meeting; (c) coordinate the Committee s compliance with this mandate; (d) participate in relevant education to ensure they acquire, maintain, and expand a sound understanding of best governance practices and meeting protocol; (e) work with management to develop the Committee s annual workplan and meeting agendas; and (f) provide reports on the work of the Committee to the Board of Directors. 1 The Board Independence Standard is not currently approved by the Concentra Board of Directors. Additional work is required to finalize and approve the Board Independence Standard to ensure that the Board is both independent from Senior Management and to ensure that the Board s behaviour and decision-making process be objective and effective, taking into consideration the specific shareholder/ownership structure of the company. APPROVED BY THE BOARD JUNE 19, 2014 PAGE 2
In order to preserve the neutrality of the position, the Chair may only vote if required to break a tie, and may not vote to cause a tie. When a tie vote triggers the Chair s right to vote, the Chair may choose to abstain from voting, causing the motion to fail. 6. Quorum A quorum shall be a majority of the members of the Committee. 7. Meetings The members of the Committee shall hold meetings as required to carry out this mandate, and in any case, no less than once quarterly. The Chair of the Committee, any two members of the Committee, the Chair of the Board or the President and Chief Executive Officer may call a meeting of the Committee by notifying the Corporate Secretary of the Company who will notify the members of the Committee in accordance with the requirements set out in section 8 of this mandate. Meetings may be conducted with members present, or by telephone or other communications facilities that permit all persons participating in the meeting to hear or communicate with each other. 8. Notices of Meetings Notice of a meeting of the Committee shall be presented by the Corporate Secretary, in writing (which includes an electronic or facsimile notice), not less than two working days prior to the meeting at the member s contact information last recorded with the Corporate Secretary. Any member of the Committee may in any manner waive notice of a Committee meeting and attendance at a Committee meeting is waiver of notice of the meeting, except where a member attends for the express purpose of objecting to the transaction of any business on the ground that the meeting is not properly called. 9. Secretary and Minutes The Corporate Secretary, his or her designate or any other person the Committee requests shall act as secretary at Committee meetings. Minutes of Committee meetings shall be maintained by the Corporate Secretary and subsequently presented to the Committee for approval. 10. Access to Management and Outside Advisors APPROVED BY THE BOARD JUNE 19, 2014 PAGE 3
The Risk Committee shall have unrestricted access to management and employees of the Company. The Risk Committee shall meet separately with the Chief Risk Officer at each regularly scheduled meeting. The Committee shall have the authority to retain and terminate external legal counsel, consultants or other advisors to assist it in fulfilling its responsibilities and to set and pay the compensation for these advisors without obtaining the prior approval of the Board or any officer of the Company. The Committee shall ensure its expenditures are reasonable, and shall report such expenditures to the Board of Directors. The Company shall provide appropriate funding, as determined by the Risk Committee, for the services of these advisors. 11. Meetings Without Management The Risk Committee shall hold unscheduled or regularly scheduled meetings or portions of regularly scheduled meetings, in camera, at which management is not present. 12. Review of Committee Functioning The Committee shall conduct an annual evaluation of its contribution and effectiveness in fulfilling its mandate, and at least annually review and assess the adequacy of its mandate and submit same to the Governance and Nomination Committee for amendment and approval by the Board of Directors. 13. Access to Other Committees The Chair or any member of the Committee may request the input of another Board Committee on any accountability or responsibility set out in this mandate. In particular, the Committee shall at least once every annum, participate in a joint committee meeting with the Human Resources and Compensation Committee to facilitate information sharing and to review risks associated with compensation programs and provide input into matters such as compensation decisions and succession planning. The Risk Committee may designate a sub-committee to review any matter within this mandate as the Committee deems appropriate. 14. Reporting The Committee shall retain minutes or other records of its proceedings and shall report to the Board of Directors on material matters following each meeting and report as required to other committees of the Board on issues relevant to them. APPROVED BY THE BOARD JUNE 19, 2014 PAGE 4
Duties and Responsibilities The Risk Committee shall have the functions and responsibilities set out below, as well as any other matters that are specifically delegated to the Committee from time to time by the Board. 1. Identification and Management of Risk (a) Review and recommend for approval by the Board of Directors on a regular basis: the Enterprise Risk Management Framework and the supporting umbrella risk frameworks including the Risk Appetite Framework; the Entity Level Risk Appetite Statement and related metrics; the risk frameworks for material risks, corporate policies aligned with risk appetite and risk limits and risk-taking authority delegated to management the credit risk strategy; proposals for significant strategic initiatives, including material outsourcing proposals; the Company s risk-based capital requirements and management s evaluation of the effectiveness of the Company s internal capital adequacy assessment process (ICAAP) for determining these requirements; and the Company s business interruption and recovery plan and testing results (b) Review quarterly risk reporting from management which includes independent reporting by the Chief Risk Officer on the following: significant and emerging risks to which the Company is exposed including relevant stress testing results; the Company s risk profile as measured against its approved risk appetite an evaluation of the Company s actual performance against the Risk Appetite Statement; and the Company s adherence to corporate policies for significant risks (c) Review the following on a regular basis: the alignment of the strategic plan with the Entity Level Risk Appetite Statement APPROVED BY THE BOARD JUNE 19, 2014 PAGE 5
(d) (e) reporting on the effectiveness and execution of the credit risk strategy within risk appetite the Company s risk assessment processes relative to new strategies, products or services the effectiveness of the corporate insurance program the status of all material outsourcing arrangements Approve, in advance, transactions that exceed the level of authority delegated to management through corporate policy, and report decisions to the board directly thereafter. Review exceptions to risk appetite and corporate policy and proposed remedial action plans (including relevant stress testing results) upon management s discovery of an exception, and report to the board directly thereafter. Risk Oversight Function Oversee the Risk Oversight function, having regard to its independence from the businesses whose activities it reviews, by: reviewing and approving on a regular basis the mandate of the Chief Risk Officer and the Risk Oversight function reviewing and approving on a regular basis the organizational structure of the Risk Oversight function annually reviewing and approving the Risk Oversight function s budget and resources, ensuring it has adequate resources and independence to perform its responsibilities annually assessing the effectiveness of the Chief Risk Officer and the Risk Oversight function reviewing the results of periodic 3 rd party independent reviews of the Risk Oversight function ensuring that the Chief Risk Officer has unfettered access and a functional reporting line to the Risk Committee reviewing regular reports prepared by the Chief Risk Officer together with management s response and follow-up on outstanding items, as necessary providing a forum for the Chief Risk Officer to raise any risk issues APPROVED BY THE BOARD JUNE 19, 2014 PAGE 6
Resources The President/Chief Executive Officer will appoint internal resources as required to the Committee. Key Dates Approved by Board of Directors: JUNE 19, 2014 APPROVED BY THE BOARD JUNE 19, 2014 PAGE 7