Société Générale / Risk report 2021 - Pillar 3 2020

10 OPERATIONAL RISK OPERATIONAL RISK MONITORING PROCESS | SOCIETE GENERALE GROUP | PILLAR 3 - 2021 191 assessing the risk exposure of each activity that remains once the p risk prevention and mitigation measures are taken into account (the “residual risk”), while disregarding insurance coverage; remedying any shortcomings in the prevention and control systems, p by implementing corrective action plans and defining key risk indicators; if necessary, in the absence of an action plan, risk acceptance will be formally validated by the appropriate hierarchical level; adapting the risk insurance strategy, if necessary. p Key risk indicators Key risk indicators (KRIs) supplement the overall operational risk management system by providing a dynamic view (warning system) of changes in business risk profiles. Their follow-up provides managers of entities with a regular measure of improvements or deteriorations in the risk and the environment of prevention and control. A cross analysis of Group-level KRIs and losses is presented to the Group’s Executive Committee on a quarterly basis via a specific dashboard. Analyses of scenarios The analyses of scenarios serve two purposes: informing the Group of potential significant areas of risk and contributing to the calculation of the capital required to cover operational risks. These analyses make it possible to build an expert opinion on a distribution of losses for each risk category and thus to measure the exposure to potential losses in scenarios of very severe severity, which can be included in the calculation of the prudential capital requirements. In practice, various scenarios are reviewed by experts who gauge the severity and frequency of the potential impacts for the Group by factoring in internal and external loss data as well as the internal framework (controls and prevention systems) and the external environment (regulatory, business, etc.). Governance is established in particular, to: allow the approval of the annual scenarios update programme by p the Risk Committee (CORISQ); allow the approval of the scenarios by the senior management of the p Business and Corporate Divisions, through the Internal Control Coordination Committees of the departments involved or through ad hoc meetings; conduct an overall review of the Group’s risk hierarchy and of the p suitability of the scenarios through CORISQ. New product Committees Each division submits their new product proposals to a New Product Committee (commercial products only). The Committee, jointly coordinated by the Risk Division and the relevant businesses, is a decision-making body which decides the production and marketing conditions of new products to customers. country, operational, legal, accounting, tax, financial, information systems risks as well as the risks of compliance, reputation, protection of personal data and corporate social responsibility risks, etc.) have been identified, assessed and, if necessary, subjected to mitigation measures allowing the acceptance of residual risks. The Committee aims to ensure that, before any product launch, all types of induced risks (credit, market, liquidity and refinancing, The definition of “new product” extends from the creation of a new product or service to the development of an existing product or service as soon as this development is likely to generate different or higher risks. The development may be linked to matters such as a new regulatory environment, to marketing on a new scope or to a new type of clientele. Outsourcing of services Some banking services are outsourced outside the Group or within the Group ( e.g. in our shared service centers). These two subcontracting channels are supervised in a manner adapted to the risks. A framework with standards and a tool helps ensure that the operational risk linked to outsourcing is controlled, and that the conditions set by the Group’s approval are respected. It helps to map the Group’s outsourcing with an identification of the activities and BU/SUs concerned, and to put outsourcing under control with knowledge of risks and with suitable supervision. During the study phase, the businesses decide on the outsourcing of services within the framework of standards set by the Group. Outsourcing projects are led by a project manager and validated by the sponsor who accepts the residual risk level after a risk analysis based on expert opinions. This ensures the consistency of the assessments and the consistency of decisions across the Group. The analysis includes, at a minimum, operational risks (including fraud, execution risk, etc.), legal, tax, non-compliance, reputation, supplier, human resources, social and environmental responsibility, business continuity risks, risks related to data quality, and risks related to information security and data protection. Legal experts use the same definition of essential outsourcing of services as that defined in the Decree of 3 November 2014. All outsourced services are then monitored at a frequency defined by their level of risk. Services at Group level are subject to reinforced monitoring through very regular contractual monitoring. These services are identified using criteria such as the concept of “core business activity”, financial impact and reputation risk. These services are validated by a dedicated Committee, chaired by the Operational Risk Department. A closing phase is used to manage the outflow of services. Crisis management and business continuity The crisis management and business continuity systems aim to mitigate as far as possible the impacts of potential incidents on customers, staff, activities and infrastructure, thus protecting the Group’s reputation, the image of its brands, and its financial resilience. These systems also satisfy regulatory requirements. The approach used to implement and track the business continuity systems of each Group entity is based on a methodology that meets international standards.