Item - 2025.TTA4.3

The Audit & Risk Management Committee:

1. Received this report for information.

2. Authorized that the information contained in the Confidential Attachment remain confidential as it contains information about the security of the property of the local board.

The Audit, Risk and Compliance Department (ARC) has been tasked with progressing the maturity of the Enterprise Risk Management (ERM) Program at the TTC and provides this report to the Audit & Risk Management Committee (ARMC) to share information on the status of the ERM Program.

This report provides an overview of the following items:

Key Enterprise Risks Overview: Provides an overview of the 10 Key Enterprise Risks that the TTC has identified as inherent to its operations and business environment. The identification and assessment of these Key Enterprise Risks define the types and level of exposure that the TTC may encounter in the pursuit of its objectives and Corporate Plan. The identification, assessment, monitoring, and reporting of these Key Enterprise Risks is intended to assist in the prioritization of proactive mitigation strategies and to provide information to support decision-making.

Risk Appetite Statements Update: ARC facilitated the development of Risk Appetite Statements for the TTC’s 10 Key Enterprise Risks as communicated in the 2025 ERM Roadmap. The development of these Risk Appetite Statements was completed in collaboration with key stakeholders throughout 2025 and articulates the acceptable levels of risks the TTC is willing to accept or take in relation to each Key Enterprise Risk. The use of these Risk Appetite Statements and forthcoming tolerance limits will enable the organization to promote consistency in decision-making related to risks, manage the effects of uncertainty, and build stakeholder confidence.

2025 ERM Roadmap Update: This report provides the details of ARC’s annual roadmap of deliverables that were highlighted in March 2025. Evaluating progress against annual goals ensures adequate progress and allows for refinement of actions, if necessary, to adapt to any changing priorities or emerging threats in the business environment. ARC has successfully completed all planned activities as outlined in this roadmap and will now commence the development of the 2026 ERM Roadmap.