2021 Universal Registration Document

2 RISK FACTORS AND INTERNAL CONTROL Risk factors

SALE AND DELIVERY OF PROJECTS AND MANAGED/OPERATED SERVICES ❙

Risk description For fixed-price projects and managed or operated services, lack of quality or failure to meet the standards expected of services and defined in contracts may give rise to various risks for Sopra Steria, such as contractual penalties, client complaints, claims for damages, non-payment, additional costs, early contract termination and reputational risk. These types of projects and services account for two-thirds of the Group’s consolidated revenue. In the current environment, clients’ demands are becoming increasingly complex due to speed of execution, the agility required and the technical nature of solutions, as well as due to strict regulatory requirements, for example for the financial sector. These demands increasingly factor in corporate responsibility, particularly in terms of reducing the environmental impact of information systems developed or managed. A poor assessment of the scale of the work to be done, an underestimate of the cost of providing the service or an incorrect estimate of the technical solutions to be implemented can lead to estimated costs being exceeded or contractual deadlines not being met. This delay can, in itself, result in penalties and/or budget overruns, resulting in additional costs and potentially impacting operating margins.

Risk management measures Managing clients’ demands and maintaining production quality are central priorities for the Group. In order to ensure the quality of management and execution of services, the Group has developed a series of methods, processes and controls. In particular, the Group uses a Delivery Rule Book (a set of 32 mandatory rules covering everything from pre-sales to the end of the production phase for services). The selection of Project Directors and of Project Managers responds to specific requirements and criteria according to the level of risk and project complexity. Particular attention is paid before any appointment is made. Project managers receive specific training. These courses are regularly updated to include issues meriting special attention and warnings relating to risks. In addition to project and line management, Industrial Managers under the authority of business unit/subsidiary managers and reporting functionally to the Group Industrial Department are responsible for monitoring all projects as well as the application of the production rules. The review of proposals and contracts by line management, but also by the Industrial Department, the Legal Department and the Finance Department, is an integral part of the Group’s controls implemented to fulfil its commitments. Indicators known as pre-sales KPIs are used throughout the Group to monitor these quality milestones and ensure that they are achieved. In addition, projects are reviewed on a regular basis, at key phases in their production life cycle. These

reviews, which are organised by the Industrial Department or by its local representatives, provide an external perspective on the status and organisation of the delivery. The achievement of quality milestones laid down in the Delivery Rule Book for the production cycle is notably measured via compliance reviews based on various checklists. Depending on its outcome, a compliance review may be supplemented by a more in-depth review of the project in question. Monthly steering meetings facilitate an overview of quality at all levels, the monitoring of established annual quality targets and the determination of the appropriate action plans to continuously improve production performance and the quality of Sopra Steria products and services. The effective implementation of actions agreed during steering meetings, audits and reviews is checked by the Industrial Department. As regards industrialisation, the Group has continued to invest heavily in the resources required to rapidly develop and operate digital solutions for its clients, designed to run in the cloud environment: the Digital Enablement Platform (DEP); implementation accelerators based on the build-to-reuse/reuse-to-build approach, which, as well as improving efficiency and productivity, aim to reduce the environmental impact of development; and digital factories to deliver service offerings combining consulting and software (e.g. cloud migration and modernisation of information systems).

42

SOPRA STERIA UNIVERSAL REGISTRATION DOCUMENT 2021