Société Générale / Risk report 2021 - Pillar 3 2020

4 INTERNAL CONTROL FRAMEWORK INTERNAL CONTROL | SOCIETE GENERALE GROUP | PILLAR 3 - 2021 39 Within the internal control framework, operational management is responsible for verifying the proper and continuous running of the risk security and management operation functions through the effective application of established standards, defined procedures, methods and requested controls. with other expert functions ( e.g. sourcing, legal, tax, human resources, information system security, etc.) and by the businesses; Accordingly, these functions must provide the necessary expertise to define in their respective fields the controls and other means of risk management to be implemented by the first line of defence, and to ensure that they are effectively implemented; they conduct second-level permanent control over all of the Group’s risks, employing the controls they have established, where appropriate the third line of defence is provided by the Internal Audit Division, p which encompasses the General Inspection and Internal Audit functions. This division performs periodic internal audits that are strictly independent of the business lines and the permanent control function; internal control coordination, which falls under the responsibility p of a Deputy Chief Executive Officer, is also provided at Group level and is rolled out in each of the divisions and core businesses. A Deputy Chief Executive Officer is responsible for ensuring the overall consistency and effectiveness of the internal control system. This Deputy Chief Executive Officer also chairs the Group Internal Control Coordination Committee (Group ICCC), which comprises the Chief Risk Officer, the Chief Financial Officer, the Group Chief Compliance Officer, the Group Chief Information Officer, the Head of Group Internal Audit, and the Head of Internal Control Coordination. The Group Internal Control Coordination Committee met 12 times in 2020. It addressed the following issues: review of the effectiveness of permanent control in each Business p Unit (BU) and Service Unit (SU); review of the effectiveness and consistency of the Group internal p control framework; review of the Group quarterly permanent control dashboard prior to p its communication to the Group Audit and Internal Control Committee (CACI); transversal review of cybersecurity and security tools and resources. p the Head of Business Unit (BU) and Service Unit (SU), these Committees bring together the competent Heads of Internal Audit and Permanent Control for the Business Unit (BU) and Service Unit (SU) in question, as well as the Head of Group Internal Control Coordination and the Heads of the Group-level control functions. The organisation implemented at Group level to coordinate the actions of the various participants in internal control is coordinated in each Business Unit (BU) and Service Unit (SU). All of the Group’s BUs and SUs have an Internal Control Coordination Committee. Chaired by Permanent control system The Group’s permanent control system comprises: first-level permanent control, which is the basis of the Group's p permanent control, is performed by the businesses. Its purpose is to ensure, at operational level, the security, quality, regularity and validity of transactions completed; second-level permanent control, which independent of the p businesses, concerns three divisions, i.e. the Compliance, Risk and Finance Divisions. In 2018, General Management initiated a transformation programme of the Group’s permanent control system, which is under its direct supervision. Through a set of actions focusing on areas such as standards, methods, tools, procedures and training, the programme served to consolidate the control culture and optimise risk control, and thus helps to improve the quality and the reliability of services provided to our customers and partners. All scheduled deadlines were