Société Générale / Risk report 2021 - Pillar 3 2020

4 INTERNAL CONTROL FRAMEWORK INTERNAL CONTROL PILLAR 3 - 2021 | SOCIETE GENERALE GROUP | 40 met and the programme’s long-term activities are being transferred to operating teams. The transfer is set to be completed in 2021. FIRST-LEVEL PERMANENT CONTROL Permanent Level 1 controls, carried out on operations performed by BUs and the SUs, ensure the security and quality of transactions and the operations. These controls are defined as a set of provisions constantly implemented to ensure the regularity, validity, and security of the operations carried out at operational level. The permanent Level 1 controls consist of: any combination of actions and/or devices that may limit the p likelihood of a risk occurring or reduce the consequences for the company: these include controls carried out on a regular and permanent basis by the businesses or by automated systems during the processing of transactions, automated or non-automated security rules and controls that are part of transaction processing, or controls included in operational procedures. Also falling into this category are the organisational arrangements ( e.g. , segregation of duties) or governance, training actions, when they directly contribute to controlling certain risks; controls performed by managers: line managers control the p correct functioning of the devices for which they are responsible. As such, they must apply formal procedures on a regular basis to ensure that employees comply with rules and procedures, and that Level 1 controls are carried out effectively. Defined by a Group entity within its scope, Level 1 controls include controls (automated or manual) that are integrated into the processing of operations, proximity controls included in operating procedures, safety rules, etc. They are carried out in the course of their daily activities by agents directly in charge of an activity or by their managers. These controls aim to: ensure the proper enforcement of existing procedures and control p of all risks related to processes, transactions and/or accounts; alert management in the event of identified anomalies or p malfunctions. Permanent Level 1 controls are set by management and avoid, as far as possible, situations of self-assessment. They are defined in the procedures and must be traced without necessarily being formalised, e.g. preventive automated controls that reject transations that do not comply with system-programmed rules. In order to coordinate the operational risk management system and the permanent Level 1 control system, the BUs/SUs deploy a specific department called CORO (Controls & Operational Risks Office department). SECOND-LEVEL PERMANENT CONTROL The permanent Level 2 control ensures that the Level 1 control works properly: the scope includes all permanent Level 1 checks, including p managerial supervision checks and checks carried out by dedicated teams; detection of anomalies, and the quality of their follow-up, and thus contribute to the evaluation of the effectiveness of Level 1 controls. this review and these audits aim to give an opinion on (i) the p effectiveness of Level 1 controls, (ii) the quality of their implementation, (iii) their relevance (including, in terms of risk prevention), (iv) the definition of their modus operandi, (v) the relevance of remediation plans implemented following the The permanent level 2 control, control of the controls, is carried out by teams independent of the operational. These controls are performed centrally by dedicated teams within Risk Service Unit (RISQ/CTL), Compliance Service Unit (CPLE/CTL) and Finance Service Unit (DFIN/CTL) and locally by the second-level control teams within the BU/SUs or entities. Internal audit Reporting to the Group Head of Inspection and Audit, the Inspection and Audit Service Unit (IGAD) is the Group’s third line of defence. The IGAD Service Unit comprises General Inspection (IGAD/INS), Internal Audit Departments (IGAD/AUD) and a support function (IGAD/COO). To fulfil its mandate, the Group’s IGAD Service Unit has adequate resources from a qualitative and quantitative point of view. The Group’s Inspection and Audit Service Unit has about 1,100 employees. The Group Head of Inspection and Audit reports directly to the Group Chief Executive Officer, with whom it has regular meetings. The Group Head of Inspection and Audit meets regularly with the Chairman of the Board of Directors. The Audit and Internal Control Committee and the Risk Committee refer to the Group Head of Inspection and Audit on their initiative or at his request on any subject. The Group Head of Inspection and Audit participates in the Internal Control Committee and the Risk Committee meetings. Moreover, bilateral meetings are held as needed between the Group Head of Inspection and Audit and the chairpersons of these Committees. The Inspection and Audit Service Unit (IGAD) is part of the Group’s internal control framework. IGAD carries out an internal audit mandate through its missions. In that role it is strictly independent from the Group’s business units and permanent control functions. In line with standards set by the IIA (Institute of Internal Auditors), IGAD’s internal audit mandate is defined as an independent and objective activity that provides the Group with assurance as to how effectively it is controlling its operations, advises on improvements and contributes to the creation of added value. By carrying out this mandate, Inspection and Internal Audit help the Group to achieve its targets, by evaluating systematically and methodically, its processes for risk management, control and corporate governance and making proposals to increase their efficiency. The Inspection and Audit Service Unit exercises a key role in the Group’s risk management set-up and can assess any of its components. Under this mandate, the General Inspection and Internal Audit assess (i) the quality of risk management within an audited scope, (ii) the permanent control framework is adequately structured and effective, (iii) management’s risk awareness and compliance with conduct rules and expected professional practices. Whilst Audit Departments are delivering solely an internal audit role, General Inspection has, in addition to its internal audit role, a mandate to undertake other engagements such as any type of analysis or research mission, be involved in the assessment of strategic projects or intervene on specific subjects as requested by General Management. Such assignments, limited with regards to resources dedicated to them, are carried out within a framework ensuring that ethical principles defined in Institute of Internal Auditors’ Standards are being met.