Société Générale / Risk report 2021 - Pillar 3 2020

10 OPERATIONAL RISK ORGANISATION OF OPERATIONAL RISK MANAGEMENT PILLAR 3 - 2021 | SOCIETE GENERALE GROUP | 188 Operational risk is the risk of losses resulting from inadequacies or failures in processes, personnel or information systems, or from external events. Societe Generale’s operational risk classification is divided into eight event categories: commercial litigation; p disputes with authorities; p errors in pricing or risk evaluation including model risk; p execution errors; p fraud and other criminal activities; p rogue trading; p loss of operating resources; p IT system interruptions. p This classification is declined into 58 risk categories, cornerstone of the Group risk modelling, ensuring consistency throughout the system and enabling cross-business analyses throughout the Group (see section 10.2), particularly on the following risks: risks related to information and communication technologies p and security (cybercrime, IT systems failures, etc.); risks related to outsourcing of services and business continuity; p risks related to the launch of new products/services/activities for p customers; non-compliance risk (including legal and tax risks): risk of p court-ordered, administrative or disciplinary sanctions, or of material financial loss, due to failure to comply with the provisions governing the Group’s activities; reputational risk: risk arising from a negative perception on the p part of customers, counterparties, shareholders, investors or regulators that could negatively impact the Group’s ability to maintain or engage in business relationships and to sustain access to sources of financing; misconduct risk: risk resulting from actions (or inactions) or p behaviour of the Bank or its employees inconsistent with the Group’s Code of Conduct, which may lead to adverse consequences for our stakeholders, or place the Bank’s sustainability or reputation at risk. The framework relating to the risks of non-compliance, reputation and inappropriate conduct is detailed in Chapter 13 “Compliance risk, litigation”. ORGANISATION OF OPERATIONAL RISK 10.1 MANAGEMENT The Group operational risk management framework, other than non-compliance risks detailed in Chapter 13 “Risk of non-compliance, Litigation”, is structured around a two-level system with the following participants: a first line of defence in each core Business Units/Service Units, p responsible for applying the framework and putting in place controls that ensure risks are identified, analysed, measured, monitored, managed, reported and contained with the limits set by the Group-defined risk appetite; a second line of defence: the Operational Risk Department within p the Group’s Risk Division. In particular, the Operational Risk Department: conducts a critical examination of the BU/SUs management of p operational risks (including fraud risk, risks related to information systems and information security, and risks related to business continuity and crisis management); sets regulations and procedures for operational risk systems and p production of cross Group analyses; produces risk and oversight indicators for operational risk p frameworks. overview of the Bank’s risk profile that is holistic, prospective and valid for both internal oversight purposes and regulatory reporting. To cover the whole Group, the Operational Risk Department has a central team supported by regional hubs. The regional hubs report back to central, providing all information necessary for a consolidated The regional hubs are responsible for implementing the Operational Risk Division’s briefs in accordance with the demands of their local regulators. The Operational Risk Department communicates with the first line of defence through a network of operational risk correspondents in each Business Units/Service Units. Concerning risks specifically linked to business continuity, crisis management and information security, the Operational Risk Department carries out the critical review of the management of these risks in connection with the Group Security Division. Specifically, regarding IT risks, the Operational Risk Department carries out the critical review of the management of these risks in connection with the Resources and Digital Transformation Department. Second-level control Level 2 control consists of verifying the definition and actual performance of level 1 controls, and in particular the examination of the results of level 1 controls in quantitative and qualitative aspects, in particular with regard to completion rate, anomaly levels, etc. This review also ensures the effectiveness and relevance of the deployment of controls by control needs and risk type and of corrective action plans.