Table of Contents CITIZENS, INC. management and other related functions. Each company we acquire has been converted onto our administrative system. This system has been in place for more than 30 years and has been updated on an ongoing basis as technology has evolved. We are currently reviewing technology options to transition from our legacy administration system to an upgraded, modernized technology platform that will service our policy administration needs into the future. We have outsourced the operations and maintenance of our legacy system that manages the administration and accounting of our current block of insurance contracts to a third-party provider. The Company has an enterprise risk management function ("ERM") that analyzes the Company’s risks on an individual and aggregated basis and is responsible for ensuring that the Company’s risks remain within its risk appetite and tolerances as determined by management with oversight from the Audit Committee. The Company's focus on ERM strengthens its risk management culture and discipline. The mission of ERM is to support the Company in achieving its strategic priorities by: ENTERPRISE RISK MANAGEMENT ENTERPRISE RISK MANAGEMENT STRUCTURE AND GOVERNANCE Effective risk oversight is an important priority for the Company’s Board and senior management team. While it is the job of the President and Chief Executive Officer and senior management to assess and manage the Company’s risk exposure through ERM, the Audit Committee of the Board is charged with discussing guidelines and policies to govern the process by which ERM is handled. The Audit Committee periodically discusses the Company’s major financial risk exposures and the steps management has taken to monitor and control such exposures. The four broad categories of risk exposures assessed and managed by senior management include, but are not limited to: In addition, any other risk that poses a material threat to the operational and/or strategic viability of the Company is immediately reviewed and assessed. In addition to the Audit Committee, the Compensation Committee considers the risks that may be presented by our executive compensation philosophy and programs, and the Nominating and Corporate Governance Committee oversees the Company’s governance practices, director succession and committee composition and leadership to manage risks associated with corporate governance. Although risk oversight is conducted primarily through committees of the Board, the full Board has retained responsibility for general oversight of risks. The Board satisfies this responsibility through full reports by each committee chair regarding the committees’ considerations and actions, as well as through regular reports directly from officers responsible for oversight of particular risks within the Company. December 31, 2019 | 10-K 6 • Strategic risk, including international business risks; • Insurance risk, including those arising out of catastrophes and acts of terrorism; • Financial risk, including market, credit and liquidity risks; and • Operational risk, including cybersecurity risk and legal and regulatory compliance risks. • providing insight to assist in growing the businesses and achieving optimal risk-adjusted returns within established guidelines. • providing a comprehensive view of the risks facing the Company, including risk concentrations and correlations; • helping management define the Company’s overall capacity and appetite for risk by evaluating the risk return profile of the business relative to the Company’s strategic intent and financial underpinning; • assisting management in setting specific risk tolerances and limits that are measurable, actionable, and comply with the Company’s overall risk philosophy; • communicating and monitoring the Company’s risk exposures relative to set limits and recommending, or implementing as appropriate, mitigating strategies; and