DERICHEBOURG - Universal registration document 2019-2020

3

Group management report Risk factors

Risks

Risk management systems

Information technology risks

The Group has a reliable IT organization based on duplicating machine rooms, tested failover plans and the regular backup of data. During the next year, the Group will prepare business recovery plans. The Group considers that the majority of its operating activities can continue for several hours in the absence of the Group’s IT capabilities. The Group endeavors to ensure that each of its businesses is of sufficient size and experience to address all of their challenges. As the Group wholly controls the vast majority of its subsidiaries, such cases are few in number. The potential risks of such situations are regularly reviewed.

A major IT incident (hardware failure, cybercrime, etc.) could affect the Group’s activities.

Legal risks and development risks

For service activities, the Group may called upon to offer services that are in addition to those already offered and this may present costing and performance risks. Risk of a disagreement with a joint venture partner that could lead to a deadlock or to commitments given by the Group that exceed its share in the Company.

Significant ongoing litigation

See section 4.27 to the consolidated financial statements.

Risks related to the consequences of inappropriate behavior

Initiatives to raise awareness (for accountants, transfer order signatories, etc.) of these risks, limiting the number of people authorized to work on payment flows. Implementation of the provisions of the Sapin 2 Law, in particular involving training initiatives for employees affected by these matters.

Risk of fraud (impersonation fraud, factoring fraud, etc.).

Reputational risk and risk of being banned for a period from participating in public tender processes following an irregularity in a tender process.

Liquidity risk

See note 4.11.3 to the consolidated financial statements and section 3.2.6

Image risk

Because of its number of employees, or the visibility of its activities, the Group may find itself involuntarily represented on social networks or other media, in connection with transactions initiated by internal or external persons who do not share the decisions made.

These events can be of high intensity, but generally of fairly short duration. Having a long-term lead shareholder should help us navigate such periods more easily.

The internal control system 3.3.3 Internal control objectives 3.3.3.1

Description ofthe general organization 3.3.3.2 of internal control Derichebourg Group's internaclontrol function The internal control functionreports to the SecretariatGeneral. Internal control manages the risk managementsystem put in place by the Group. Its objectivesare: asset protection; p the reliabilityof financial information; p implementing the instructions and guidelines set by the executive p body; compliancewith laws and regulations; p the proper functioningof internal processes. p It enables: the Group'sactivitiesto be managedin the best possibleway; p

The purpose of internal control is to prevent and control risks inherent in the Company’s business and the risk of errors and fraud in the accounting and financial fields, in particular. As with any control system, it cannot provide assurance that risks will be totally controlled or eliminated. Control procedures mainly seek to ensure that managerial actions, transactions and staff behavior comply with the guidelinesand rules the Company’sgoverningbodies have set forth to govern the Company’s business as well as the applicable laws and regulations. The purpose of these control procedures is also to ensure that the accounting, financial, legal and economic informationprovided to the Company’s structures and that may be provided to third parties pursuant to regulatory requirements or as part of the Group’s communicationpolicy, is reliable and faithfully reflects the Company’s businessand position.

DERICHEBOURG p 2019/2020 Universal Registration Document 109