Société Générale / Risk report 2021 - Pillar 3 2020

3 RISKMANAGEMENT ORGANISATION RISK APPETITE PILLAR 3 - 2021 | SOCIETE GENERALE GROUP | 28 the abovementioned indicators are supplemented by stress test p frameworks or on nominal ones in order to capture risks that are more difficult to measure: the more extreme correlation risks are measured via stress tests - at different levels (wrong-way risk, stress monitoring at sector level, risk on collateralised financing activities and agency), the CVA risk is measured via a stress test in which representative - market scenarios are applied, notably involving the credit spreads of our counterparties; exposures to clearing houses (CCP) are subject to specific p supervision: the amount of collateral posted for each segment of a CCP: the - initial posted margins, both for our principal and agency activities, and our contributions to CCP default funds, in addition, a stress test measures the impact linked to the - default of a member of a CCP; the Global Stress Test on market activities includes cross p market-counterparty risks, it is described in more detail in the “Market risk” section. Market risk The Group’s market activities are carried out in the context of a business development strategy primarily focused on meeting client requirements with a full range of products and solutions. Market risk is strictly managed through a set of limits for several indicators (such as stress tests, Value at Risk (VaR) and stressed Value at Risk (SVaR), “sensitivity” and “nominal” indicators). These indicators are governed by a series of limits proposed by the business lines and approved by the Risk Division within the framework of a discussion-based process. The choice of limits and their calibration reflect qualitatively and quantitatively the fixing of the Group’s appetite for market risks. A regular review of these frameworks also allows risks to be controlled in a closely manner according to changing market conditions with, for example, a temporary reduction of limits in case of a deterioration. Warning thresholds are also in place to prevent the possible occurrence of overstays. Limits are set at different sub-levels of the Group, thereby cascading down the Group’s risk appetite from an operational standpoint within its organisation. Within these limits, the Global Stress Test limits on market activities and the Market Stress Test limits play a pivotal role in determining the Group’s market risk appetite; in fact, these indicators cover all operations and the main market risk factors as well as risks associated with a severe market crisis which helps limit the total amount of risk and takes account of any diversification effects. Operational risk (including reputation and compliance risk) The Group is exposed to a diversity of operational risks inherent in its business: execution errors, internal and external fraud, IT system failures, malicious acts against IT systems, loss of operational resources, commercial disputes, failure to comply with tax obligations, but also risk of non-compliance, unappropriated behaviour or even reputation. As a general rule, the Group has no appetite for operational risk or for non-compliance risk. Furthermore, the Group maintains a zero-tolerance policy on incidents severe enough to potentially inflict serious harm to its image, jeopardise its results or the trust displayed by customers and employees, disrupt the continuity of critical operations or call into question its strategic focus. The Group underscores that it has is no or very low tolerance for operational risk involving the following: internal fraud: the Group does not tolerate unauthorised trading by p its employees. The Group’s growth is founded on trust, as much between employees as between the Group and its employees. This implies respecting the Group’s principles at every level, such as exercising loyalty and integrity. The Group’s internal control system must be capable of preventing acts of major fraud; cybersecurity: The Group has zero tolerance for fraudulent p intrusions, in particular those resulting in the theft of customer data or a major operational disruption. The Group intends to introduce effective means to prevent and detect this risk. It is adequately organised to deal with potential incidents; data leaks: the Group is committed to deploying the necessary p resources and implementing controls to prevent, detect and remediate data leaks. It does not tolerate any leaks of its most sensitive information, in particular that of customer data; business continuity: the Group relies heavily on its information p systems to perform its operations and is therefore committed to deploying and maintaining the resilisence of its information systems to ensure the continuity of its most essential services. The Group has very low tolerance for the risk of downtime in its information systems that perform essential functions, in particular systems directly accessible to customers or those enabling it to conduct business on financial markets; outsourced services: the Group seeks to achieve a high degree of p thoroughness in the control of its activities entrusted to external service providers. As such, the Group adheres to a strict policy of reviewing its providers; managerial continuity: the Group intends to ensure the managerial p continuity of its organisation to avoid the risk of a long-term absence of a manager that would question the achievement of its strategic objectives, which might threaten team cohesion or disrupt the Group's relationships with its stakeholders. Structural interest rate and exchange rate risks, risk to employee commitments The Group measures and strictly controls structural risks. The mechanism whereby rate risk, foreign exchange risk and the risk on pension/long-service obligations is controlled is based on sensitivity or stress limits which are broken down within the various businesses (entities and business lines). There are four main types of risk: rate level risk, curve risk book, optional risk (arising from automatic options and behavioural options) and basis risk, related to the impact of relative changes in interest rates indices. The Group’s structural interest rate risk management primarily relies on the sensitivity of Net Present Value (“NPV”) of fixed-rate residual positions (excesses or shortfalls) to interest rate changes according to several interest rate scenarios. Limits are set by the Finance Committee or the Board of Directors at the Business Unit/Service Unit and Group levels. Furthermore, the Group measures and controls the sensitivity of its net interest margin (“NIM”) on different horizons.