Société Générale / Risk report 2021 - Pillar 3 2020

3 RISKMANAGEMENT ORGANISATION RISK MANAGEMENT ORGANISATION PILLAR 3 - 2021 | SOCIETE GENERALE GROUP | 34 The Corporate Secretary brings together: p the Group Legal Department, which ensures in particular the - security and legal regularity of the Group's activities, drawing on the legal services of subsidiaries and branches where applicable, the Group Tax Department, which ensures compliance with tax - laws in France and abroad, the Corporate Social Responsibility Department, which is in - charge of defining and proposing a policy in favour of Corporate Social Responsibility within the Group, the Group Security Department, which oversees the Group's - security in conjunction with the Service Unit of the Resources and Digital Transformation Department regarding the security of information systems, the Group's Administrative Department, which provides the - Group's central administration services and provides support, as necessary, to the Secretary of the Board of Directors; The Human Resources and Communication Division monitors the p implementation of compensation policies, amongst other things; The Corporate Resources and Innovation Division is specifically p responsible for defining information system security policies; The Group Internal Audit and General Inspection Division is in p charge of internal audits and reports to the Head of Group Internal Audit. According to the last census carried out on a declarative basis (as of 31 December 2020), the full-time equivalent workforce (FTE): of the Group's Risk Department represent around 5,463 FTE: p including 4,620 as second line of defence, i.e. 1,536 within the - Group Risk Division itself and 3,084 in the rest of the Risk sector: the Risk Management Function, and including 857 as first line of defence on issues of operational - risks, crisis management and the fight against fraud; the Compliance function had approximately 3,900 FTE employees; p the Information System Security function had approximately p 630 FTE employees. Risk reporting and assessment systems The Group’s data aggregation system operates at two levels and has clearly defined responsibilities. The teams of Business Units and Service Units and entities provide data collection and quality functions for both local and Group consolidation needs, as well as a first level of aggregation when necessary. The cross-business teams of the Finance Department and the Risk Department aggregate this data and produce Group-wide risk indicators and reports. Since 2015, the Group has defined architectural principles relating to Finance and Risk information systems. The TOMFIR principles (Target Operating Model for Finance & Risk) revolve around the following objectives: the production of risk indicators is based on data from Business p Units and certified entities (Golden sources), the granularity of the contract and accounting quality. The data are updated daily and fed by the operational systems of the entities; the Group-level information system manages its own data p aggregation rules to avoid multiplying local developments at BU and entity level. It is based on Group-wide benchmarks, subject to the benchmarks of Business Units and entities; the IS architecture must address Finance and Risk uses to meet local p needs and needs shared with the Group. These architectural principles are applied to the following four main application areas: the mutual Finance and Risk information system for credit risk and p the calculation of RWA; interest rate and liquidity risk calculation chains; p the market risk calculation chain; p the counterparty credit risk calculation chain on market operations. p The significant strengthening of the Finance and Risks information system launched in 2015, in line with the TOM-FIR architecture principles, was initially aimed at increasing our data aggregation and risk management capacities. Despite the delay in the first half of 2021 of some milestones in the planned trajectory, the action plans have been largely implemented and allow the Group to reach a new level of maturity at the end of 2020 with: feeding the Group's credit risk systems with the commitments of p retail customers at contract level on all the BCBS 239 priority entities; the ability to produce liquidity indicators more quickly in a crisis p situation on the most critical perimeter; deployment of data warehouses on new significant entities in the p Retail Banking and International Financial Services scope; the faster production of monthly Group rate risk indicators; p the ability to manage the NIM (Net Interest Margin) centrally over a p wide area; the industrialisation of almost all of market risk’s main indicators p and the strengthening of the certification of these indicators by centralising controls and alerts.