Danone // 2020 Universal Registration Document

Overview of activities, risk factors 2.7 Control environment DANONE UNIVERSAL REGISTRATION DOCUMENT 2020 34 Internal control system Framework: DANgo The internal control framework used by Danone is DANgo (Danone Governing and Operating Processes), which it developed in 2003 and completely updated in 2018. It covers the following operating processes: Sales, Purchasing, Operations, Human Resources, Finance, Information Systems and General Secretary and includes a Control Environment section. All these processes are broken down into 41 risk areas covered by 96 internal control points (Danone Internal Control Evaluations). For each risk area, the framework specifies the potential impacts for Danone: reputational harm, errors in the financial statements, financial losses, disruptions in operating activities and frauds. Scope Danone’s internal control framework applies to all the fully conso- lidated subsidiaries. Assessment scope Internal control at all the subsidiaries level, is assessed based on a differentiated approach and the depth of this assessment depends on each subsidiary’s size and risk level. Assessment methodology The assessment of internal control is not the result of self-assess- ment questionnaires but relies on the testing of control points by the local internal controllers. Since the control framework is centered around risk control, it is the degree of exposure to these risks that is assessed by the local internal controllers for each of the control points within the assessment scope. The procedures for testing and assessing the degrees of exposure to risks are set out in guidelines and specific instructions issued by the Internal Control Department. In addition, this assessment by the subsidiaries is regularly subject to internal audits (see hereafter). Reporting of assessments Each subsidiary’s internal control assessments are reported to the Corporate Internal Control Department in July and December of each year through a tool used by all the subsidiaries. In addition, they always include action plans for each control point when necessary (see section Review of assessments hereafter). Assessment of internal control by the Internal Audit Department The Internal Audit Department conducts audits according to a risk- based approach to ensure the quality of theDANgo assessment carried out by the subsidiaries. In light of the reinforcement of the Internal Audit teams and heightened compliance requirements, these audits periodically identify differences in the subsidiaries’ assessments compared with the central assessments. Communication has been strengthened with the management of the Reporting Entities and key functions concerning these differences. In 2020, the Internal Audit Department conducted 33 internal audits at subsidiaries or cross-company functions, based on the plan previously approved by the Audit Committee. Thanks to the development of a new tool that extracts, analyzes and formats data from Danone’s integrated management system, the Internal Audit teams conducted 26 audits remotely during the Covid-19 pandemic. Following each audit, an action plan is prepared by the management of the subsidiary to correct weaknesses identified in the audit report. The implementation of action plans is monitored by the operational and functional managers, under the supervision of the Internal Audit Department. In 2020, 18 follow-up audits on implementation of action plans were conducted within 12 months of the initial audit when possible. Moreover, the Treasury and Financing, Tax, Information Systems, Nature & Water Cycle, Legal /Compliance, Food Safety, Quality, Industrial, Safety, Organization, Human Resources and Crisis Management departments arrange audits and periodic control reviews at the subsidiaries level, in addition to the general internal audits. Monitoring of Internal Control Monitoring of indicators The main indicators monitored by the Internal Control Department are high-risk control points. Annual objectives Danone sets annual internal control priorities (the subsidiaries and operational risks that will take priority). These priorities are approved by General Management and the Audit Committee. Review of assessments This review is carried out at all levels of Danone’s organization. The internal control results are first presented to each subsidiary’s management committee for a review of areas of vulnerability, a discussion of their criticality and prioritization and monitoring of action plans. The internal control results are also presented to each of the senior executives of the operating processes covered by DANgo and to the senior executives of the Finance function. Lastly, the Audit Committee and General Management are informed at least twice a year of the status of the subsidiaries’ assessment processes, the results thereof and the actions being taken to improve the effec- tiveness of the system. Communication and Coordination Dedicated platforms An electronic version of the DANgo framework, with a link to Danone’s policies and guidelines, is available to all Danone employees. In addition to DANgo, an intranet site for Danone’s internal controllers and a Danone social network include all themethodology documents related to internal control (instructions, test scripts, methodology guides) and facilitate the sharing of internal control best practices.