Société Générale / Risk report 2021 - Pillar 3 2020

10 OPERATIONAL RISK OPERATIONAL RISK MONITORING PROCESS PILLAR 3 - 2021 | SOCIETE GENERALE GROUP | 190 A central team at the Resources and Digital Transformation Department is in charge, on IT processes, of the consistency of the implementation of operational risk management systems and their consolidation. The main missions of the team are: identifying and evaluating the major IT risks for the Group, including p extreme risk scenarios ( e.g. cyberattack, failure of a provider), to enable the Bank to improve its knowledge of its risks, be better prepared for extreme risk scenarios and better align their investments with their IT risks; produce the indicators that feed the IT risks monitoring dashboard, p intended for management bodies and information systems Directors. They are reviewed regularly with the second line of defence in order to remain aligned with the IS and SSI strategy and their objectives; more generally, ensuring the quality and reliability of all devices p addressing IT operational risks. Particular attention is paid to the permanent control system for its IT risks, which is based on the definition of normative IT and security controls and the support of the Group in the deployment of managerial supervision on this subject. As part of the “PCT” programme to transform permanent control, the normative controls were reviewed, ie around thirty controls on IS/SSI subjects. The IT Department monitors the deployment of these controls across the Group, the progress of which is aligned with the objectives set by the Group. In terms of awareness, a multilingual online training module on information security is mandatory for all internal Group staff and for all service providers who use or access our information system. It was updated in early 2020 in order to incorporate changes to the new Group Information Security Policy. At the end of November 2020, 92% of Societe Generale group employees who had been notified had validated the training. OPERATIONAL RISKMONITORING PROCESS 10.2 The Group’s main frameworks for controlling operational risks are as follows: collection of internal losses and significant incidents and analysis of p external losses; self-assessment of risks and controls; p oversight of risk indicators; p development of scenario analyses; p framing new products; p management of outsourced services; p crisis management and business continuity; p management of risks related to information and communication p technologies. Collection of internal loss and significant incident data Internal losses have been compiled throughout the Group since 2003, in addition to significant incident data since 2019. The process: defines and implements the appropriate corrective actions; p achieves a deeper understanding of risk areas; p enhances awareness and vigilance with respect to operational risks p in the Group. Losses (or gains or near-misses) are reported from a minimum threshold of EUR 10,000 throughout the Group, except for global market activities, where the threshold is EUR 20,000. Incidents without financial impact are also reported when they are deemed significant according to their impact, in particular on contractual commitments, reputation, day-to-day operations, risk appetite or the level of regulatory compliance of the Group. Analysis of external losses External losses correspond to the data on operational losses suffered by the banking and financial sector, provided by databases managed by external providers, as well as the data shared by the banking industry as part of consortiums. These data are used to enhance the identification and assessment of the Group’s exposure to operational risks. Risk and control self-assessment Under the Risk and Control Self-Assessment (RCSA), each manager assesses the exposure to operational risks to which each entity within the relevant scope is exposed through the activities in order to improve their management. The method defined by the Group consists of taking a homogeneous approach to identifying and evaluating operational risks and frameworks to control these risks, in order to guarantee consistency of results at Group level. It is based notably on a repository of activities. The objectives are as follows: identifying and assessing the major operational risks (in average p amount and frequency of potential loss) to which each activity is exposed (the intrinsic risks, i.e. those inherent in the nature of an activity, while disregarding prevention and control systems). Where necessary, risk mapping established by the functions ( e.g. Compliance, Information Systems Security, etc.) contributes to this assessment of intrinsic risks; assessing the quality of major risk prevention and mitigation p measures;