BPCE_PILLAR_III_2017

1 GENERAL STRUCTURE OF GROUPE BPCE’S INTERNAL CONTROL SYSTEM Structure of Groupe BPCE’s internal control system

The division heads must expedientlynotify the Head of Internal Audit of any failure or major incident brought to their attention. The Head of Internal Audit, along with the Heads of the Group’s Risk division and of the Complianceand PermanentControl division, must quickly inform each other of any audit or disciplinaryprocedure initiated by the supervisory authorities, or more generally of any external audit broughtto their attention. Activities in 2017 As part of the full cycle of investigationsit conductsover an average of four years, and drawing on risk assessmentsthat it keeps regularly updated for each institution,the Group’s InspectionGénérale division completed its audit plan mostly as scheduled, making a few adjustmentsrelated to ongoingentity restructuringinitiativesinitially providedfor in the plan, and to regulatorypriorities.It also conducted a half-yearly follow-up on the implementation of its own recommendations as well as those of the Autorité de contrôle prudentiel et de résolution (ACPR) and the Single Supervisory Mechanism (SSM). Pursuant to Article 26 of Ministerial Order A-2014-11-03 on internal control, the Group Inspection Générale division’s alert mechanism is used to inform the Risk Management Committee of significant delays in the implementation of these recommendations. Structure of the Audit department Groupe BPCE’s Inspection Générale division oversees all audit processes. Its operatingprocedures– aimed at achievingconsolidated supervision and optimal use of resources – are set out in a charter approved by BPCE’s Management Board on December 7, 2009. This charter wasupdatedin June 2016. The aim of this structure is to ensure coverage of all Group operationalor support units within the shortest possible timeframe, and to achieve effective coordination with each entity’s Internal Audit division. The Internal Audit divisions of affiliates and directly-owned subsidiaries have a strong functional link to the Group’s Inspection Générale division and a hierarchical link to their entity’s executive body. This strong functional link is established throughthe followingrules: the appointment or dismissal of Internal Audit directors of the ● affiliatesor direct subsidiariesis subjectto the prior approvalof the Group Head of Internal Audit; the existenceof a single Group Audit Chartercoveringall of Groupe ● BPCE. It sets out the purpose, powers, responsibilitiesand general organization of the Internal Audit process in the overall internal control system and is applied to all Group companiesmonitoredon a consolidated basis. The charter is broken down into thematic standards (audit resources, audit of the sales network, audits, follow-up of recommendations, etc.); the Group’s InspectionGénérale division ensures that the Internal ● Audit divisions of Group entities have the necessary resources to perform their duties; the budget and staff levels of these divisions are set by the executive body of the affiliates and subsidiaries, in conjunction with the Group’s InspectionGénérale division; AUDIT DEPARTMENT

the Internal Audit divisions use audit methods defined by the ● Group’s Inspection Générale division that are drawn up in consultation with them; the multi-year and annual audit programs of the Internal Audit ● divisions are established with the approval of the Group’s InspectionGénérale division,which then consolidatesthe programs. The Group’s InspectionGénérale division is kept regularly informed of their implementationand of anychanges inscope; the entities trans, it their Internal Audit reports to the Group’s ● InspectionGénérale divisionas and when they are issued; audit reports from regulatoryauthoritiesrelatingto entities,related ● follow-up letters and answers to those letters, and sanction procedures are transmitted to the Group’s Inspection Générale division when they are received or issued, if sent directly to the institution; the Group’s Inspection Générale division is notified as soon as ● possible of the start of audits performed by regulators on entities and subsidiaries,as well as anyproceedings againstthem; the annual reports of the entities preparedpursuantto Articles ● to 264 of Ministerial Order A-2014-11-03on internal control are sent to the Group’s Inspection Générale division, which forwards them to the supervisory authorities. This type of structure is duplicated at parent company subsidiaries and affiliates. The rules governing how the internal inspection business line is managed between Natixis and the central institution are part of Groupe BPCE’saudit process. Given the scope and nature of the audit function’s activities, the Group’s InspectionGénérale division and Natixis’ InspectionGénérale share coverage of the audit scope. They each conduct audits. A CoordinationCommitteemeets regularlyand involvesboth Inspection Générale divisions. It is responsible for all issues related to the operation of Internal Audit between the central institution and Natixis group. Activities in 2017 BPCE’s Inspection Générale division keeps audit standards and methodology regularlyupdated basedon best practices. The preparation and updating of audit guides were continued to maintain a current body of uniform guidelines covering the most commonly audited areas. In 2017, the division focused on methodologyin updating guides on financial security and KYC, ALM and accounting.A workinggroup was also formed to update the sales network audit guide. Another audit guide was drawn up for the Procurement function. Supplemented by appendices and supporting documentation, these audit guides are primarily accessible via the Group’s audit function’s intranet and/or the Group Inspection Générale ’s shared server. Priority audit items were also defined in terms of credit risk, compliance risk (AML-TF, Fraud, controls of investment services), financial risk (ALM, Cash management,Trading floor), accounting, finance control, the cooperative shareholder base and risk-takers. 258

11

Risk Report Pillar III 2017