The Bank’s comprehensive risk management is developed in compliance with current regulations and internal standards as defined by the Board of Directors, in relation to market, credit/ counterparty, liquidity and operational risk, among others.

Z7_OHHGG4G0P0O2A06I9FP1KM3KQ5

This management is strengthened with the three lines of model, with a cohesive and coordinated approach, in which its independence is guaranteed. Within the Corporate Governance Framework, the roles of the responsible areas in each line are defined, according to the level of responsibility in Grupo Bancolombia, in order to guarantee effective and efficient coordination among them for risk management (in its different stages) and internal control.

At the same time, the organization has a general comprehensive risk management framework called enterprise risk management (ERM), consisting of:

Government and Organization Risk

Scheme of integrated risk management, organizational chart, structure, government, boards and committees.

Risk Appetite and liquidity management

Definitions, indicators, limits, SVA Model - Profitability and Price, management report, allocate capital.

Risk management tools and information

Dashboard and risk maps, monitoring of risk positions and maturity models.

Z7_OHHGG4G0P0O2A06I9FP1KM3KQ7

Enterprise Risk Management

Traditional Risk

Credit - Market - Liquidity - Counterparty - Operational...

Evolving Risk

Concentration - Strategic - Contagion - Cyber -Models...

New Tendencies

Third-party - ESG/Climate - Talent - Political...

Z7_OHHGG4G0P0O2A06I9FP1KM3K64

Risk Management Organization:

The CRO is responsible for risk management of Grupo Bancolombia and he does it through local CRO’s from each company that is part of the Group. The corporate governance model gives him direct authority over risk management, which guarantees through the risk framework, the existance of committees and hierarchical structure.

The CRO reports directly to the CEO with a hierarchical level that allows direct access to the Board of Directors, Risk Committee and Audit Committee; his functions are:

Design policies and methodologies to identify, measure, monitor and control risk.

Evaluate limits and risk exposure.

Inform risk Committee and/or the board about risk management.

The comprehensive risk management is integrated and coordinated with other activities of the organization and has advanced methodologies that allow us to identify the different risks to which it is exposed, including emerging risks.

Additionally, the Board of Directors and the Risk Committee give the guidelines to set the tolerance limits and risk appetite for the main risk indicators; it is measured and monitored periodically by type of risk.

Z7_OHHGG4G0P0O2A06I9FP1KM3I45

Risk information and monitoring

Monitoring compliance with policies, limits, measurement of exceptions, bulletins, and periodic reports of risks for each business units with information about identified risks, progress in action plans, relevant events, and indicators. Also, we have a regular report for the board of directors, which provide information about risk management, with emphasis on the main risks, including alerts, expectations and changes in policies, methodologies, and risk management issues in general. Additionally, to manage the risk profile of the Bank we have three lines framework, with responsabilities and roles for each line.

Grupo Bancolombia has expert areas in operational risk issues that are always accompanying the business to identify risks and events in a personalized way, at the same time it has a channel available to all its collaborators to report potential risks, as well as events or losses materialized. Through this mechanism, we seek to extend to all collaborators the possibility of participating in the risk management system when required. Additionally, to identify proactively credit risk events Bancolombia has a committee to analyze and monitor clients in “Watch List Situation (AEC) and stablish action plans to improve Bancolombia’s position referred to each client.

Z7_OHHGG4G0P0O2A06I9FP1KM32F6

Management Report – 2022

Risk Management Report is an annual report created for every interest group (our clients, employees, shareholders, among others) about risk management, including emerging risk and information of public knowledge. See pages 99 to 133:

Go to report

Z7_OHHGG4G0P0O2A06I9FP1KM32V0

Risk management culture

Within its organizational culture, Grupo Bancolombia identifies six cultural characteristics which drive and reinforce behaviours: Integrity, Customer, High Performance, Sustainable Growth, Humanity and Dynamism. These bind the commitment of the organization with careful and proper risk management.

Additionally, the organization’s Code of Ethics promotes and disseminates the values of responsibility, respect, proximity, and integrity. An internal Ethic Line is available, through it, employees, board members, shareholders and suppliers can report anything they deem to be unethical.

Grupo Bancolombia has training programs, both virtual and face to face, including corporate programs related with risk topics. Some of these are mandatory, such as Operational Risk, SOX law and SARLAFT. Additionally, it includes several training plans for commercial areas and risk areas strengthening the organization’s commitment to risk management.

Furthermore, each year we implement communication strategies that allow us to promote a risk culture across the company. These strategies are created for different audiences, according to their role in the three lines of model, which allows understanding and awareness when managing risks.

Z7_OHHGG4G0P0O2A06I9FP1KM3K66

investment