Welcome to Day 2 of the ProcessUnity Customer Summit! Kellie

Welcome to Day 2 of the ProcessUnity Customer Summit! Kellie Shea, Senior Marketing Programs Manager, ProcessUnity

Today’s Agenda Vendor Intelligence Suite 11:00 AM to 11:45 AM Matt Bianchi, Lead Product Manager of Solutions and Ecosystem Ros Morville, Sr. Product Marketing Manager Case Study: Trustmark 11:50 AM to 12:35 PM John Hester, Vice President of Internal Audit Jeff Johnson Executive Director Enterprise Vendor Management Break 12:35 PM to 12:50 PM RFX/Sourcing 12:50 PM to 1:35 PM Brendan Cavalier & Tom Vatour – Implementation Team Partner Panel Discussion 1:40 PM to 2:25 PM BitSight, Crowe, RapidRatings, & EcoVadis Case Study: Live Nation 2:30 PM to 3:15 PM Emily Wall, Sr Director, Global Ethics & Compliance

ProcessUnity Vendor Intelligence Suite May 19, 2021

Agenda 1 Vendor Intelligence Suite Overview 4 Vendor Cyber Intelligence 2 Vendor Identity Intelligence 5 Vendor Financial Intelligence 3 Vendor Screening Intelligence 6 Vendor ESG Intelligence

ProcessUnity Vendor Intelligence Suite Enrich Third-Party Risk Lifecycle Processes with Targeted Risk Intelligence Vendor Identity Intelligence Vendor Screening Intelligence Capture Holistic Risk Postures & Streamline Third-Party Reviews More accurate onboarding via targeted embedded ratings Deeper due diligence based on specific risk domains Vendor Risk Management Vendor Cyber Intelligence Automated monitoring between periodic vendor assessments Automated issue identification and creation Vendor Financial Intelligence Vendor ESG Intelligence Streamlined reporting by risk domain for visibility across vendor population

VIS: Intelligent Assistants Hands-Free Automation Expert Ratings Confirm Vendor Submissions & Continuously Scan for Material Changes Vendor Request PRE-CONTRACT VENDOR ONBOARDING IDENTITY VERIFIED FINANCIAL ISSUE IDENTIFIED CREATE ISSUE ESG RATING CONFIRMED Signed Contract Previous Assessment POST-CONTRACT DUE DILIGENCE CYBER RATING PASS CYBER RATING FAIL REASSESS VENDOR NOW Next Assessment

Vendor Intelligence Suite Components Targeted Risk Intelligence Identity: Fully configured configured third-party risk third-party risk program program with turnkey turnkey workflow, risk analysis workflow, risk analysis and reporting reporting and Developed by SMEs via hundreds of Developed by SMEs via hundreds of third-party risk third-party risk implementations, implementations, deep market deep market understanding understanding and and industry experience industry experience Industry-standard SIG questionnaires (SigLite, SigCore) with inherent-riskbased scoping Built-in processes, content and reports content and reports that customers customers canthat modify over time* can modify over time* Rapid deployment model with minimal implementation costs COMPLETE PROVEN COMPREHENSIVE CONFIGURABLE COST-EFFECTIVE Built-in processes, Financial: Cyber: Risk Screening: ESG: Questionnaires: THIRD-PARTY DATA MODEL WORKFLOWS & ASSESSMENTS CALCULATIONS & SCORING SIG is a trademark of Shared Assessments , a registered trademark of Santa Fe Strategy Center. 1 All capabilities are included but may not be deployed based upon the customer’s chosen deployment options. Customers are licensed to deploy the capabilities at any time during the active subscription. 2 QUESTIONNAIRES ANALYTICS

Incorporate Targeted Intelligence in the TPRM Workflow Validation Questionnaire Find & Identify Vendor Request Vendor Screen Identify UBOs Risk Screen UBO Screen ESG Due Diligence Cyber Financial Results Review Risk Decision Supporting Evidence

Vendor Identity Intelligence

Vendor Identity Intelligence with Dun & Bradstreet ABOUT Built on ProcessUnity’s Best Practice Program with Prebuilt Connector to D&B Incorporate Vendor and Beneficial Owner searches in Onboarding and Ongoing Process to Identify: Correct Entity to Streamline and perform Due Diligence Ultimate Beneficial Ownership of thirdparty service providers Establish a Program to truly Know Your Vendor (KYV): Shorter pre-due diligence cycles Ensure accurate data collection Provide visibility to ultimate ownership Meet global regulatory requirements Meet corporate ethical requirements Eliminate reputational risk Vendor & Beneficial Owner Search Available Configuration Vendor Risk Management D&B Connector

Components and Workflow of VII Advanced Property Configuration Ongoing Vendor Due Diligence Formatting of workflow-based Schedule periodic reviews to refresh properties within ProcessUnity to information and ownership from Dun manage vendor risk reviews & Bradstreet for more accurate due diligence Vendor Identification Beneficial Owner Repository Perform on-demand searching and Manage a centralized repository of identifying vendors to provide a more beneficial owners of vendors for comprehensive review process streamlined risk reviews for a deeper dive in the due diligence process Beneficial Owner Identification Vendor Information Reporting Perform on-demand searching of Create aggregated reporting of beneficial owners for vendors to identified vendor attributes for provide a more comprehensive enriching your vendor portfolio review process

Dun & Bradstreet Example Search for Vendor’s Identity on the Vendor Request and Vendor Object 12

Dun & Bradstreet Example Search for Vendor’s Beneficial Owners during the Due Diligence Process 13

Vendor Screening Intelligence

Vendor Screening Intelligence with Refinitiv ABOUT Built on ProcessUnity’s Best Practice Program with Prebuilt Connector to WC1 Screen Vendors and Beneficial Owners Against: Adverse Media Law Enforcement Politically Exposed Persons (PEP) Regulatory Enforcement Sanction Lists Establish a Program to Protect Against: Anti-Bribery & Corruption (ABAC) Anti-Money Laundering (AML) Anti-Organized Crime Countering the Financing of Terrorism Environmental Legislation Human Rights & Supply Chain Reputational & Ethical Risk Risk Screening Available Configuration Vendor Risk Management Refinitiv Connector

Components and Workflow of VSI Advanced Property Configuration Program Level Protection Formatting of workflow-based properties Provide program level coverage of third- within ProcessUnity to manage vendor party risk management program around risk reviews regulatory, ethical, and reputational risk coverage Vendor Screening Perform on-demand or nightly screening of Refinitiv’s vendor screenings to centralize targeted risk reviews and remediation in ProcessUnity Beneficial Owner Repository Beneficial Owner Screening Perform on-demand or nightly screening of company and individual beneficial owners in World-Check One and remediate within ProcessUnity Risk Remediation Reporting Manage a centralized repository of Create aggregated reporting of vendor beneficial owners of vendors for and beneficial owner screens for level up streamlined risk reviews for a deeper reporting of your vendor portfolio dive in the due diligence process

Refinitiv World-Check One Example Screen Vendors and their Beneficial Owners through World-Check One 17

Refinitiv World-Check One Example View and Manage all related Screening Results to the Vendor and Beneficial Owners 18

Refinitiv World-Check One Example Analysts can perform 100% of WC1 screening reviews within ProcessUnity 19

Vendor Cyber Intelligence

Vendor Cyber Intelligence with BitSight ABOUT Built on ProcessUnity’s Best Practice Program with Prebuilt Connector to BitSight Screen Vendors to Identify: Compromised Systems - devices or machines in an organization’s network that show symptoms of malicious or unwanted software Diligence - steps a company has taken to prevent attacks User Behavior –user file sharing activities that may introduce malicious software Public Disclosure – insight around breaches and security incidents Establish a Program to Provide Visibility Around: Vendor portfolio’s cybersecurity posture and risk to organization Security Ratings Available Configuration Vendor Risk Management BitSight Connector

Components and Workflow of VCI Advanced Property Configuration Centralized Issue Management Formatting of workflow-based properties Generate issues, calculate risk, ingest within ProcessUnity to manage vendor risk data, update review cadences and risk reviews more On-demand Screening Perform on-demand or nightly screening of BitSight’s cybersecurity ratings to centralize targeted risk reviews in ProcessUnity Cybersecurity Dashboard Enriched Assessments Integrate Risk Vectors to improve validation, increase data quality, aid in key decision-making by mapping risk vectors to over 160 SIG questions. Cybersecurity Risk Inclusion Vendor cybersecurity dashboard Incorporate cybersecurity ratings in provides a holistic view of all third overall risk methodology of risk ranking parties being monitored by BitSight vendor portfolio

BitSight Example Search and Subscribe vendors from within ProcessUnity during Due Diligence Cycles 23

BitSight Example Cybersecurity dashboard to provides a holistic view of all third parties being monitored by BitSight 24

Vendor Financial Intelligence

Vendor Financial Intelligence with RapidRatings ABOUT Built on ProcessUnity’s Best Practice Program with Prebuilt Connector to RapidRatings Screen Vendors to Identify: Core Health Performance Resiliency Indicators Strength of Cash Flow Strength of Generating Returns Establish a Program to Provide Visibility around: Vendor’s Financial Health Rating which measures the short-term likelihood of financial disruption based on core health and resilience analysis Vendor’s Core Health Score which measures the medium-term sustainability based on operational efficiency and competitiveness Financial Ratings Available Configuration Vendor Risk Management RapidRatings Connector

Components and Workflow of VFI Advanced Property Configuration Centralized Issue Management Formatting of workflow-based properties Generate issues, calculate risk, ingest within ProcessUnity to manage vendor risk data, update review cadences and risk reviews more On-demand Screening Perform on-demand or nightly screening of RapidRatings’ financial ratings to centralize targeted risk reviews in ProcessUnity Financial Dashboard Enriched Assessments Integrate financial ratings and reporting in assessment review to improve validation, increase data quality, aid in key decision-making Financial Risk Inclusion Targeted financial risk dashboard Incorporate financial ratings in overall risk provides a holistic view of all third methodology of risk ranking vendor parties being monitored by portfolio RapidRatings

RapidRatings Example Financial dashboard to provides a holistic view of all third parties being monitored by RapidRatings 28

Vendor ESG Intelligence

Vendor ESG Intelligence with EcoVadis ABOUT Built on ProcessUnity’s Best Practice Program with Prebuilt Connector to EcoVadis Screen Vendors to Identify: Environmental Rating Labor & Human Rights Rating Ethics Rating Sustainability Rating Establish a Program to Provide Visibility around: ESG Sustainability Ratings of Vendor Portfolio Supplier alignment around company’s corporate responsible sourcing standards Legal, customer, and talent obligations Key sustainable procurement KPIs ESG Ratings Available Configuration Vendor Risk Management EcoVadis Connector

Components and Workflow of VEI Advanced Property Configuration Centralized Issue Management Formatting of workflow-based properties Generate issues, calculate risk, ingest within ProcessUnity to manage vendor risk data, update review cadences and risk reviews more On-demand Screening Perform on-demand or nightly screening of EcoVadis ESG sustainability ratings to centralize targeted risk reviews in ProcessUnity ESG Sustainability Dashboard Enriched Assessments Integrate ESG sustainability ratings and reporting in assessment review to improve validation, increase data quality, aid in key decision-making ESG Sustainability Risk Inclusion Targeted ESG sustainability risk Incorporate ESG sustainability ratings in dashboard provides a holistic view of overall risk methodology of risk ranking all third parties being monitored by vendor portfolio EcoVadis

EcoVadis Example ESG Sustainability Risk Dashboard provides a holistic view of all third parties being monitored by EcoVadis 32

Thank You!