Blackberry 2012 Annual Report Download - page 109

(iv) Require, at least quarterly, management to update the Committee on any material or noteworthy changes relating to (1)-(3),
immediately above, and the activities of the Corporation’s Risk Management and Compliance Council;
(v) Consult periodically with the Compensation, Nomination and Governance Committee and the Strategic Planning Committee on
risk management matters within their respective purview;
(vi) Encourage an open and constructive risk dialogue between the Board and management on areas relating to risk management;
Oversight of the RPA Group and Quarterly Reviews
(i) Review the Committee’s level of involvement and interaction with the Corporation’s RPA Group, including the Committee’s line
of authority and role in appointing and compensating employees in the RPA Group;
(ii) Review and advice on the appointment, replacement, reassignment, or dismissal of the leader of the RPA Group;
(iii) Review the performance, effectiveness, degree of independence and objectivity of the RPA Group and the adequacy of its audit
process;
(iv) Review RPA Group reports, as well as management’s response to such reports, and review and approve the annual audit plan of
the RPA Group, including the proposed audit universe, priorities, staffing, and, on a quarterly basis, the status of the audit plan and
the then current assessment and management of risk;
(v) Review the effectiveness of the RPA Group’s methodology relating to its assessment of risks to the Corporation, including the
factors considered and the relative weighting of such factors, and consider changes in management’s assessment of risks;
(vi) Review with management the progress and results of all RPA Group projects, approve procedures for implementing accepted
recommendations, and, when deemed necessary or appropriate by the Committee, direct the Corporation’s Co-Chief Executive
Officer to assign additional audit projects to the leader of the RPA Group;
(vii) Meet privately with the leader of the RPA Group to discuss any areas of concern, and to confirm that (i) significant issues are
brought to the Committee’s attention, (ii) the principal risks of the Corporation’s business have been identified by management and
appropriate policies and systems have been implemented to manage such risks, and (iii) the integrity of the Company’s internal
control and management information systems are satisfactory;
101