Danone // 2020 Universal Registration Document

2 Overview of activities, risk factors 2.7 Control environment DANONE UNIVERSAL REGISTRATION DOCUMENT 2020 33 2.7 CONTROL ENVIRONMENT RISK MANAGEMENT Danone has organized its risk identification and risk management system around complementary processes: • identification and management of strategic risks, as well as the coordination of the risk map and the monitoring of global risks, under the responsibility of the Strategic Planning Department (see section 2.6 Risk factors ); • identification and management of operational risks related to the Sales, Purchasing, Operations, Human Resources, Finance, Information Systems and General Secretary functions, under the responsibility andmonitoring of the Internal Control Department (see section Internal control hereafter); • identification andmanagement of risks related to the preparation and processing of financial and accounting information (see section Financial and accounting information hereafter); • identification andmanagement of risks related to (i) corruption, (ii) anti-competitive practices, and (iii) non-compliance with personal data protection laws and international laws on trade sanctions, under the responsibility of the Compliance Department through the preparation and coordination of a Compliance Program (see section 5.1 An integrated approach of sustainable business model ); • other processes such as: • the development of procedures regarding competitive intel- ligence, training, prevention and protection, etc. as well as the initiative taken in this area by specialized departments such as the Nature &Water Cycle Department and the Quality and Safety Department for food; • the Security Department’s contribution to the identification of threats against Danone’s employees and assets; • identification of potential crisis by the Crisis Management Department and preparation by the affected entities based on the maps created at each Reporting Entity; • short decision-making channels and input from the operating uni ts in strategic discussions, which facil i tates r isk reporting. INTERNAL CONTROL Internal control objectives Internal control is put in place by Danone’s General Management, managers and operational teams with the primary aim of ensuring: • the proper functioning of Danone’s internal processes, particularly those related to safeguarding assets and the anti-corruption system introduced by the Sapin II law; • compliance with applicable laws and regulations; • reliability of financial information. In 2020, Danone adapted its internal control system, placing special emphasis on potential risks related to the Covid-19 health crisis, together with the functions responsible for the operating processes and internal control. The teams were therefore made more aware of these risks and testing procedures were developed based on an updated protocol. No significant signs of deterioration in internal control were observed across Danone. Key internal control stakeholders General Management General Management is responsible for Danone’s internal control system with support from the Finance Department, while the Audit Committee is responsible for monitoring the effectiveness of Danone’s control and risk management systems (see section 6.1 Governance bodies ). Internal Control Department Part of the Corporate Finance, Control and Services Department (see section Financial and accounting information hereafter), the Internal Control Department’s main functions include: • updating the internal control approach, including the DANgo framework, as well as the use of data analytics; • defining priorities related to internal control and presenting the results within Danone; • supporting and overseeing the international network of internal controllers through coordination, communication and training initiatives. Network of local internal controllers Internal control at Danone is carried out by a large network of local internal controllers who generally report to the finance directors of the Clusters Business Services. Their main functions are as follows: • performing and documenting work related to testing control points for the assessment of internal control based on instruc- tions issued by the Internal Control Department; • presenting the internal control results to the Management Committees and monitoring action plans; • making an active contribution to all transformation projects so that they include the aspect of internal control and risk management; • and more generally, coordinating the system vis-à-vis all the stakeholders.