Chief Audit Officer 2023 Incentive Compensation Plan

The Federal Home Loan Bank of Boston (i.e., the "Bank") has an established incentive compensation plan for the Chief Audit Officer (CAO). This Plan is intended to compensate the CAO in a manner that is consistent with the Bank’s total rewards philosophy and recognizes the importance of individual performance through metrics linked to his principal functions.

The Audit Committee of the Bank’s Board of Directors (Audit Committee) will determine participation in the Plan.

    

Criteria for determining whether an award will be payable to the CAO are based upon the goals outlined in Appendix A. The Audit Committee is responsible for setting goals, measuring their achievement, and determining the incentive payment.

Each goal will operate independently of the others.

The CAO will be assigned an incentive award opportunity that is expressed as a percentage of the incumbent’s base salary at year-end 2023, as illustrated in the chart below.

Goal achievement and individual awards for the goals as outlined in Appendix A will be calculated at the conclusion of 2023 based on results as of December 31, 2023. The CAO will be eligible to receive fifty (50) percent of such award in a cash payment, subject to the final approval of the Audit Committee, and if required, the review of the Federal Housing Finance Agency (FHFA), between March 1 and March 15, 2024.

The CAO will be eligible to receive the remaining fifty (50) percent of the award (Deferred Award) as cash between March 1 and March 15, 2026.

The deferred award will be determined at the conclusion of 2025 and will be multiplied by the following multiplier:  (1+ the greater of (A) the rate of Consumer Price Index inflation between December 2023 and December 2025, or (B) the compounded cumulative return on a 2-year Treasury note issued at the last auction of 2023 over 2

1 Maximum incentive payable in March of any year equals 100% of the plan year base salary.

years.)2  In order to ensure that recipients of deferred awards receive a minimum 1 percent return on the deferred amount, the multiplier will be subject to a floor of 1.01.

All deferred award payouts shall be subject to the final approval of the Audit Committee and review and non-objection by the FHFA (to the extent required by FHFA).

In addition to ensure continuing alignment between the Bank’s longer-term financial health and stability, the following conditions must be satisfied for participants to receive the deferred award:

•The participant is in employment with the Bank on December 31, 2025, or otherwise meets employment- related requirements, as described below in CAO ICP Administration, and

•Subject to the discretion of the Audit Committee in conference with the Board, the deferred award calculated above may be reduced, (but not to a number that is less than zero) for participant, as applicable, if, during calendar years 2024 and/or 2025, any of the following occur such that if it had occurred prior to the year-end 2023 calculations, it would have negatively impacted the goal results and reduced the associated payout calculation:

i.operational errors or omissions resulting in material revisions to (A) the 2023 financial results, (B) information submitted to FHFA supporting the goal results or payout calculation, or (C) other data used to determine the combined award at year-end 2023;

ii.submission of significant information to the SEC, Office of Finance and/or FHFA materially beyond any deadline or applicable grace period, other than late submissions that are caused by acts of God or other events beyond the reasonable control of the participants, or

iii.failure by the Bank to make sufficient progress, as determined by the FHFA, in the timely remediation of examination and other supervisory findings relevant to the goal results or payout calculation.

•All deferred award payouts shall be subject to the final approval of the Audit Committee and review and non-objection by the FHFA (to the extent required by FHFA).

The CAO ICP is administered by the Audit Committee of the Board of Directors which shall have full power and binding authority to construe, interpret, and administer the CAO ICP, and to adjust it for relevant and unforeseen circumstances.

Relevant and unforeseen circumstances may include changes in business strategy, , termination or commencement of business lines, impact of economic fluctuations, growth or consolidation of the membership base, net income above or below the level projected in the Bank’s Strategic Business Plan, or regulatory or other changes impacting the Internal Audit Department, Bank or Bank System. The Committee shall not make adjustments for circumstances that include changes to goals, weights, or levels of achievement (other than adjustments that reduce payout amounts) without re-submission to FHFA.

2 The CPI inflation rate will be calculated using the Consumer Price Index for all Urban Consumers: All Items, Monthly, Seasonally Adjusted (CPIAUCSL) or equivalent as (CPI at December 2025 – CPI at December 2023) / CPI at December 2023. (https://fred.stlouisfed.org/series/CPIAUCSL) The compounded cumulative return on a 2-year Treasury note will be calculated as (1+y/2)^4-1, where y is the par yield on a 2-year Treasury note at the last auction of 2023. (https://home.treasury.gov/policy-issues/financing-the-government/interest-rate-statistics)

The Audit Committee reserves the right at any time to amend, suspend or terminate the CAO ICP in whole or in part, for any reason, and without the consent of any CAO ICP participant but will not do so without re-submission to FHFA, if required.

CAO ICP awards shall not be considered earned or payable, in whole or in part, to any participant for any reason until they are finally determined by the Audit Committee following the end of the plan years and following the non-objection of the FHFA (to the extent required by the FHFA).

Participants must receive a performance rating of “Meets Expectations” or better for 2023 in order to be eligible to receive an CAO ICP payout.

Any individual hired or promoted into an eligible position during 2023 that is granted an award shall have any such incentive award prorated based on actual base salary paid during the plan year, providing he/she has served a minimum of three months in that role in 2023 and otherwise satisfies the CAO ICP’s requirements.

If an individual becomes a participant of the CAO ICP during the plan year, e.g. due to a job change or promotion, then any CAO ICP award will be prorated based on months in the CAO ICP, provided he/she serves a minimum of three months in the CAO ICP and otherwise satisfies the plan's requirements.

Except as described below, any CAO ICP participant who terminates employment for any reason, whether voluntarily or involuntarily, before the end of the plan year will not be entitled to any award, except as otherwise determined by the Audit Committee, at their sole discretion and subject to review of the FHFA, if required.

•CAO ICP participants who terminate employment with the Bank by reason of death or disability or who are eligible to retire3 from employment with the Bank may receive a pro rata payment of current incentive opportunity as determined by the Audit Committee and at their sole discretion and subject to the review of the FHFA, if required, based on the days of completed service as a CAO ICP participant during 2023. To be eligible, the participant must complete at least six months of service in 2023 and otherwise satisfy the CAO ICP’s requirements. For CAO ICP participants seeking to retire, a minimum of six months' advanced notice to the Bank will be required, and it must be determined that there has been an effective transition of responsibilities and completion of the DE&I objective leading to the retirement date in order for such individuals to be eligible for an award.

•CAO ICP participants who terminate employment with the Bank by reason of death or disability prior to the deferred award payment date in March 2026, or who terminate prior to the deferred award payment date and are eligible to retire from employment with the Bank, may become eligible to receive a payment of the deferred award. Participants who die, become disabled, or retire3 (and meet the eligibility requirements described above) during 2023 may be eligible to receive a pro rata payment of the deferred award as determined and recommended by the Audit Committee and at their sole discretion, and subject to the review of the FHFA, if required.

3 Eligibility to retire is defined as employees who are i) eligible for normal retirement as defined in the Pentegra Defined Benefit Plan for Financial Institutions or ii) meet the Rule of 70 as defined in the Pentegra Defined Benefit Plan for Financial Institutions, including credited service in the FHLB system, but excluding any other credited service at another Pentegra participating employer.

Awards to retiring or disabled participants or beneficiaries will be paid at the same time as awards to all active participants. Beneficiary means the participant’s (i) surviving spouse; or (ii) duly appointed and qualified executor or personal representative or estate. The Chief Human Resources Officer (CHRO) may permit participants to designate other persons as beneficiaries, but no designation of a beneficiary shall be effective unless made in accordance with the procedure specified by the CHRO and actually received by the CHRO prior to the participant’s death.

The Bank may make such provisions, as it deems appropriate, for withholding payroll taxes in connection with payment of CAO ICP awards.    

        

This metric is to ensure that the 2023 Internal Audit Plan (Plan) is completed as approved by the Audit Committee (AC). The Chief Audit Officer (CAO) shall furnish the Committee with periodic reports on the status of the Plan. The reports will indicate which audits and other activities (including SOX projects) have been completed, are in process, and those set to begin. The Audit Committee reserves the right to replace audits/activities for anticipated Audits, Information System implementations, and other Bank initiatives that are not implemented by Bank management as anticipated. In addition, the Committee reserves the right to amend/modify the Plan during the year as deemed necessary.

Threshold: Complete the planning, fieldwork, and draft of audit issues1 of 11 of the 13 Extreme, Significant, Moderate-Risk and SOX Business and IT Interim audit projects in the 2023 Audit Plan by December 31, 2023, that are scheduled for issuance in 2023. Completion of the remaining 2023 Internal Audit Plan audit projects is to be completed in Q1-2024. Changes to the Audit plan will be presented to and discussed with the Audit Committee at the end of the year to determine achievement of this measure.

1 Complete planning, fieldwork, and draft of audit issues represents that IA has completed its audit work and the only efforts remaining are to coordinate with Management to finalize audit findings, management action plans and the audit report.

Target: Threshold plus:

Audit reports (excluding implementation audits) and SOX Business and IT Interim and year end testing projects issued in 2023 from the approved 2023 and 2022 Audit Plans are within +6% of the total budgeted hours. Changes to budgeted hours will be based on changes in expected audit scope if identified during audit planning and on unforeseen circumstances. Budget changes will be approved by the CAO and presented to the Audit Committee.

Excess:

Target plus:

85% of individual audit reports from the 2023 and 2022 audit plans (excluding implementation audits) and SOX Business and IT Interim and year end audit projects issued during 2023 are within +6% of budgeted hours on an individual audit by audit basis. (e.g., if 22 of the 25 audit and SOX projects are within 6% of budget).

Between 65% and 85% of audits and SOX projects within budget plus 6% will receive pro-rated credit between Target and Excess.

Internal Audit should strive to provide value added recommendations to Bank departments. Value-add recommendations look to provide operational efficiencies to Bank activities, such as control automation, reduction of controls over specific processes, and processing efficiencies. Internal Audit process improvements may be considered for measuring this goal.

Value-added services may be provided to the Bank in the form of ad-hoc advice upon request, input on processes/controls upon request, recommendations within an audit/review, advice to the business that will benefit business processes and guidance on how to address exam findings.

The Audit Committee will assess the level of achievement above target based on information provided from management discussions, the results of the annual internal audit questionnaire from Bank management and staff and input from the CAO.

Threshold: Provide 5 value-add contributions to Bank business units. E.g., interactions with Bank business units where Internal Audit staff provide advice or recommendations that assist in improving a process or address and concern.

Target: Threshold plus provide 5 more value-add contributions to Bank business units. E.g., interactions with Bank business units where Internal Audit staff provide advice or recommendations that assist in improving a process or address and concern. In addition, interactions should include 5 instances that improve operational efficiency, reduce inefficient or unnecessary processes, or automate processes of controls.

Excess: Target plus 5 more contributions that improve operational efficiency, reduce inefficient or unnecessary processes, or automate processes of controls or provide value to the FHLB System.

Effective communication and dialogue between the Chief Audit Officer (CAO), the Chief Executive Officer, and senior management.

The Audit Committee will monitor this metric during the year at regularly scheduled quarterly meeting and at year-end through discussions with the CAO, CEO, and senior management.

Using a questionnaire, the CAO will solicit feedback from Bank staff on their interaction with the CAO and Internal Audit staff on areas such as communication, administration, and partnering activities that occurred from December 2022 and during 2023. The survey results will be anonymous and reported independently by Human Resources to the Chair of the Audit Committee.

The Audit Committee is responsible for the measurement of this metric and will take into consideration interaction between the CAO, Internal Audit staff and Bank management for this goal.

Threshold: Annual Questionnaire results indicate neutral (“within the range of 2.5 – 2.2”) overall results and confirmation from management that communications with the CAO have been two or less times a year. (Score results are on a 5-point scale, 1 is the highest rating and 5 is the lowest rating.)

Target: Annual Questionnaire results indicate good (“within the range of 2.2 – 1.65”) overall results and confirmation from management that update meetings with the CAO have been three times a year and dialogue is cooperative.

Excess: Annual Questionnaire results indicate excellent (“less than 1.65”) overall results and confirmation from management those communications with the CAO have been more frequent than three times a year and include dialogue is collaborative to improve the audit process and interaction (e.g., work to improve SOX process/controls, collaborate with ERM on approach to viewing risk, coordinate with Management to discuss systems implementations, improve SOAF reporting, etc.).

Further develop data analytics program and apply data analytics in internal audits and SOX testing.

Threshold: By April 30, 2023, present the data analytics program strategy to the Audit Committee. In addition, by July 31, 2023, develop and present a data analytics roadmap containing the key stages and deliverables to strengthen data analytics capabilities within the Internal Audit Department (across the three categories: people, process, and technology) based on the Data Analytics Program Strategy.

Target: Threshold plus, by September 30, 2023, use data analytics in two audits or SOX testing as part of planning or fieldwork (i.e., pilot process)

Excess: Target plus by December 31, 2023, use data analytics in two more audits or SOX as part of planning or fieldwork (pilot process).

Develop continuing education plans for IA staff to develop their audit skills. Identify specific professional certifications for each IA staff member to have or be working for by December 31, 2023. Provide feedback/guidance to staff and help them develop realistic

career development goals. (Leverage IIA competency framework and the Bank’s competencies framework to create development plans)

To meet continuing education requirements and develop IA team skills and careers.

Threshold: By December 31, 2023, Internal Audit professional staff obtain on average 40 hours of applicable professional training in support of professional certifications and building audit and/or Bank-specific skills and/or knowledge.

Target: Threshold plus, by June 30, 2023, develop career development and professional certification goals for team members and timeline expectations (e.g., 1 – 3 years) for achieving them.

Training areas could include data analytics, data visualization, Cyber/AWS, etc. engage third-party resources to work with Internal Audit staff to help build subject matter knowledge and experience with Internal Audit staff (e.g., engage third party resources to provide expertise in key areas such as IT, IS, Treasury, Risk Management).

Excess: Target, plus attainment of two audit related professional certifications/certificates or four staff developing career goals for 1-3 years. (e.g., CIA, CIDA, Certificate in Financial Services Audit, CISA, etc.).

Each senior leader must have an approved and documented experience or business result in either the internal or external dimension of our Bank’s DE&I Strategic Plan by December 15, 2023.

Achievement: Approval of each documented experience or business result will be determined by the Bank’s President and OMWI Director, who will review and approve an annual tracking sheet for this objective on a quarterly basis to ensure that planned and completed activities embody the intent of this objective and can be seen as driving positive results for the Bank’s DE&I Program.

Externally, the senior leader must be visible as a DE&I advocate or champion that increases the visibility of the Bank as an employer of choice for diverse talent or attracts business partners/vendors and/or highlights how our products or activities support diversity, equity or inclusion within the communities that we serve. Members, members of the New England community and other key external stakeholders can also be positively impacted in this dimension.

Internally, the senior leader must actively engage as a DE&I advocate, champion or sponsor of a Bank Business Resource Group (BRG) or a strategic initiative aligned with the capital markets, HCI, workforce, Board or supplier diversity objectives.