Société Générale / Risk report 2021 - Pillar 3 2020

3 RISKMANAGEMENT ORGANISATION RISK MANAGEMENT ORGANISATION PILLAR 3 - 2021 | SOCIETE GENERALE GROUP | 32 Setting and formalisation of risk appetite at Group level The Group's risk appetite is formalised in a document (“Risk Appetite Statement”) which sets out: the strategic profile of the Group; p its profile of profitability and financial soundness; p the frameworks relating to the management of the Group's main p risks (qualitative, through risk policies, and quantitative, through indicators). Regarding the profile of profitability and financial soundness, the Finance Department proposes each year, upstream of the budgetary procedure, to the General Management, financial targets at Group level. These targets, supplemented by alert thresholds and crisis levels according to a “Traffic light” approach, allow: to respect, with a sufficient safety margin, the regulatory obligations p to which the Group is subject (in particular the minimum regulatory solvency, leverage and liquidity ratios), by anticipating as best as possible the implementation of new regulations; to ensure, via a safety margin, sufficient resistance to stress p scenarios (stress standardised by regulators or stress defined according to a process internal to the Group). process in which the needs expressed by the businesses are confronted with a contradictory opinion independent from the second line defence. The latter is based on: The frameworks relating to risk management, also represented via a graduated approach (limits, alert thresholds, etc.), result from a independent analysis of risk factors; p the use of prospective measures based on stress approaches; p the proposal for a framework. p For the main risks, the frameworks set make it possible to consolidate the achievement of the Group’s financial targets and to orient the Group’s profitability profile. Allocation of risk appetite within the organisation The allocation in risk appetite within the organisation is based on the strategic and financial plan, and on risk management systems: on a proposal from the Finance Department to the General p Management, the financial targets defined at Group level are broken down into budget allocation targets at business level, within the framework of the budget and the strategic and financial plan; concerning the breakdown of frameworks and risk policies, it is p based on an understanding of the needs of the businesses and their business prospects and takes into account the objectives of profitability and financial soundness of the Business Unit and/or the entity. RISKMANAGEMENT ORGANISATION 3.4 Implementing a high-performance and efficient risk management structure is a critical undertaking for the group Societe Generale in all businesses, markets and regions in which it operates, as is maintaining a balance between strong awareness of risks and promoting innovation. The Group’s risk management, supervised at the highest level, is compliant with the regulations in force, in particular the Order of 3 November 2014 relating to the internal control of companies in the banking sector, payment services and investment services subject to the control of the French Prudential Supervisory and Resolution Authority (Autorité de contrôle prudentiel et de résolution – ACPR) and European Regulations Basel 3 (CRR/CRD). (See Board’s Expertise, p. 82 of the Universal Registration Document). The main objectives of the Group’s risk management strategy are: to contribute to the development of the Group’s businesses and p profitability by defining the Group’s risk appetite in conjunction with the Finance Division and the business divisions; to contribute to the Group’s sustainability by establishing a risk p management and monitoring system; to reconcile the independence of the risk management system (with p respect to the businesses) with close collaboration with the core businesses, which have primary responsibility for the transactions they initiate. Governance of risk management Two main high-level bodies govern Group risk management: the Board of Directors and General Management. General Management presents the main aspects of, and notable changes to, the Group’s risk management strategy to the Board of Directors at least once a year (more often if circumstances so require). Within the Board of Directors, the Risk Committee (see Art. 11 of the Internal rules of the Board of Directors, p. 87 of the Universal Registration Document) advises the Board of Directors on overall strategy and the appetite regarding all kinds of risks, both current and future, and assists the Board when it verifies the implementation of this strategy. The Board of Directors’ Audit and Internal Control Committee (see Art. 10 of the Internal Rules of the Board of Directors, p. 86 of the Universal Registration Document) ensures that the risk control systems operate effectively. Chaired by General Management, the specialised Committees responsible for central oversight of internal control and risk management are as follows: the Risk Committee (CORISQ), which met 22 times in 2020, has for p objective to define the Group’s key priorities in terms of risk policies (credit, country, market and operational risks), within the framework of the risk appetite and the financial targets set by the Group Strategy Committee, and to monitor compliance of same. Subject to the powers attributed to the Board of Directors, the CORISQ, based on proposals from the Risk Division, takes the main decisions relating to the management of various risks (credit risks, country risks, market and operational risks). Along with the Risks Committee, the Major Risks Committee ( Comité Grands Risques ) is an ad hoc body that validates the commercial strategy and risk taking with regard to large client groups;