Société Générale / Risk report 2021 - Pillar 3 2020

3 RISKMANAGEMENT ORGANISATION RISK APPETITE – GENERAL FRAMEWORK PILLAR 3 - 2021 | SOCIETE GENERALE GROUP | 30 RISK APPETITE – GENERAL FRAMEWORK 3.3 Risk appetite is determined at Group level and attributed to the businesses and subsidiaries. Monitoring of risk appetite is performed according to the principles described in the Risk Appetite Framework governance and implementation mechanism, which are summarised below. Governance As part of the supervision of risk appetite, the Group relies on the following organisation: The Board of Directors: p approves the Group Risk Appetite Statement and the Group Risk - Appetite Framework, as well as the Group Risk Appetite Framework, ensures that risk appetite is relevant to the Group’s strategic and - financial objectives and its vision of the risks of the macro-economic and financial environment, reviews quarterly the risk appetite dashboards presented to it, - and is informed of risk appetite overruns and remediation action plans, sets the compensation of corporate officers, sets out the - principles of the remuneration policy applicable in the Group, especially for regulated persons whose activities may have a significant impact on the Group’s risk profile, and ensures that they are in line with risk management objectives. The Board of Directors relies primarily on the Risk Committee. General Management: p approves the Risk Appetite Statement and its Risk Appetite - Framework based on the proposal of the Chief Risk Officer and the Deputy General Manager, Head of Finance, regularly ensures that risk appetite is respected, - ensures the effectiveness and integrity of the risk appetite - implementation system, ensures that the risk appetite for the Group’s Business Units and - subsidiaries/branches is formalised and translated into frameworks consistent with the Group’s risk appetite, ensures internal communication of risk appetite and its - transposition in the Universal Recording Department. In addition, the main mission of the Risk Department is to develop the Group’s risk appetite, as well as the implementation of a risk management, monitoring and control system. The Finance Department contributes to setting this risk appetite in the framework of indicators under the responsibility of the Finance Committee (profitability, solvency, liquidity and structural risks). The Compliance Department is also responsible for instructing the risk appetite setting for indicators falling within its scope. Identification of risks The identification of risks is the cornerstone of the Group's risk management framework which implies on an ongoing basis the whole of Business Units and allows to identify all the risks (1) that are or could be significant. The approach is global and holistic: it covers all types of risks and all Group exposures. In addition to the annual review of the Group’s risk taxonomy in the context of risk appetite, risk identification is based on two pillars in order to ensure a complete and up-to-date view of all the material risks facing the Group is exposed: risk management governance and key committees such as CORISQs p at Group or Business Unit level or New Product Committees making it possible to monitor changes in the risk profile for all types of risk (credit, market, operation, etc.). In addition to monitoring well-identified risks, this governance can also generate a debate between risk experts and senior management on emerging risks. This debate is fueled by the latest market news, early warning signals, internal alerts, and more; a series of exercises aimed at identifying additional risks, for p example arising from changes in macroeconomic or sectoral conditions, financial markets, regulatory constraints, competitors/ market pressure, business model (effects concentration) and changes in banking organisations. These additional identification exercises are also organised by risk types, but include some identification of the effects of cross-risk ( e.g. credit and market or credit and operational). For a given type of risk, these exercises analyse/segment the Group’s exposure along several axes (Business Unit/activity/customer/product/region...). For the perimeters where this risk is assessed as significant, the underlying risk factors are identified. When a significant risk is identified, a risk management system, which may include a quantitative risk appetite (risk ceiling/threshold) or a risk policy, is implemented. In addition, where possible, the risk factors underlying a significant risk are identified and combined in a dedicated scenario, and the associated loss is then quantified by means of a stress test (see also section “Risk quantification and stress test system”). Risk quantification and stress test system For each material risk identified, indicators to measure this risk are put in place to ensure monitoring. These indicators can be based on measurements of outstanding amounts (risk weighted or not), sensitivities to the variation of one or more risk factors (interest rate, etc.), impacts of stress tests based on scenarios, etc. These indicators can be expressed as ratios and are sometimes the subject of regulatory or publication requirements. Risks are classified on the basis of the Group's risk taxonomy, which names and defines the categories of risks and their possible subcategories. (1)