EFTA01356554

Guidelines The purpose of this closure pack is to provide the overview of the Finding Owner's remediation efforts to address the finding and is to be completed by the Finding Owner. This document should be completed and uploaded to GFMS with all other relevant evidence when submitting the closure request in GFMS. One document is expected per Finding. Please prefix the document name with the finding GFMS ID p. See the DB Group consolidated Findings Management Policy for overview of review responsibilities for Finding Owners. If any residual risk remains, consider whether a rating downgrade or a risk acceptance) is more appropriate than requesting closure. For Findings where a DCO r ICO review is required ahead of closure by the Division as per the Findings Management Policy, this document together with its attachments will be the primary evidence reviewed by DCO ICOs to support their approval or rejection of the Finding closure. The DCO I ICO review follows guidance defined in Appendix 1 and the Finding Owner might be required to update ! complement their closure submission to address concerns identified during the DCO ICO review. For Findings which require a Group Audit (GA) standalone validation as per the Findings Management Policy. this document will be the starting point for the closure validation by GA. As such, evidence of operating effectiveness of new / amended controls need to be provided as part of closure submission by the Finding Owner (see appendix 2 for the sample size requirements to demonstrate operating effectiveness). Where Finding closure documentation needs to be shared with external parties, these two documents (where applicable) will be consolidated into one closure pack. Document structure: 1. Background- This section provides the text of the finding and a summary of the response provided by the Finding Owner. 2. Overview of remediation - This section includes a narrative that provides an overview of remediation actions completed by DB management (Finding Owner) to address the underlying risks and deficiencies targeted by the Finding. WUe completing this section, take a holistic view of issues and focus on the underlying risk exposure and root cause instead of addressing superficial symptoms. Where possible, remediation should take a holistic approach instead of having a narrow focus (e.g. is the identified risk more pervasive than just the instance identified in the finding). If no holistic approach has been taken. explain the rationale for this. 3. Reference documents - This section provides a list of all documents related to the remediation and internal closure of the finding which should be uploaded to GFMS as evidence, and show how they support the closure request by evidencing the work completed and providing the necessary samples, where relevant. 4. Appendix - This section covers reference information only: The DCO / ICO guidance, the sustainability timeframes for new and amended controls (and associated sample size) as well as the closure review timeframes. It can be removed from the closure pack at point of submission by the Finding Owner. Additional details about the finding closure and validation process can be found in the Bank-wide Findings Management For internal use only Page 2o4 12 CONFIDENTIAL - PURSUANT TO FED. R. CRIM. P. 6(e) DB-SDNY-0042461 CONFIDENTIAL SDNY_GM_00188645 EFTA01356554