GROUPAMA / 2020 UNIVERSAL REGISTRATION DOCUMENT

3 CORPORATE GOVERNANCE AND INTERNAL CONTROL Internal control procedures

Group Risk Management Department (DRG) (a) In terms of risk management,as of the end of 2020, the GroupRisk Management Department (DRG) has a dedicated team of eight people and is more specifically involved in areas related to financial and insurance risks. In 2020, the main actions undertaken by the teams in the Group Risk Management Department focused on: assessment of the Group’s Major Risks, revision and ❯ strengthening of reporting to the Group’s governance bodies; preparation and coordination of specialised Risk Committees; ❯ completion of the annual systemof assessmentand collectionof ❯ insurance and financial risks for all of the Group’s entities; definition of the common methodological principles of ❯ assessment and preparationof a genericORSA report proposed by the Group Risk ManagementDepartment,which serves as a basis for the entities to draw up their final report; support for the Risk Managers of the Group’s entities for the ❯ processes of assessing risks and finalising their ORSA reports; the implementationof a risk tolerance framework for the Group, ❯ to be rolled out within the entities in a second phase. Both at Group level and at the entity level in France and internationally, the ORSA process was presented as work progressed,with approvalssought at each stage from the Steering Committees of Groupama Assurances Mutuelles and Risk ManagementCommitteesof GroupamaAssurancesMutuelles and the entities. At the same time, the Boards of Directorsof the Group’s insurance companies were involved – directly or through the Audit and Risk Management Committee upstream of the ORSA work (particularly through the validationof calculationassumptionsand the choice of scenarios adopted) – and examined the results then approved their company’s report before transmission to the local control authorities in accordance with the regulations. Group Operational Risk Management and (b) Permanent Control Department (DROCPG) As of the end of 2020, the Group Operational Risk Management and Permanent Control Department (DROCPG) has a dedicated teamof 15 peopleand is involvedespeciallyin the scope relating to the management of operational risks and permanent control activities and is also in charge of the coordination of work to validate the partial internal model, major changes, and the SCR calculation by the internal model. In 2020, the major tasks undertaken by the teams in the Group Operational Risk Managementand PermanentControl Department focused on: assessingoperational risks particularlyon the basis of the Group ❯ nomenclature and the Group assessment methodology; updating the nomenclature of operational risks; ❯ deploying an updated version of the communityoperational risk ❯ management and control reporting tool; supporting the Group’s entities in the implementation of their ❯ Business Continuity Plan in line with the Group policy: testing drills, workshops, plenary session of Managers in the entities,

deployment of a crisis management solution, and provision of examples of good practices; updating the document reference system; ❯ managing the network of risk and internal control officers and ❯ organising meetings to discuss experiences through regular workgroups and the COMOP (Operational Implementation Committee),attendedby the ARCC (Risk Management,Control, and ComplianceAudit) Managers of the main companiesof the Group’s France scope; carrying out work to update and align the control plans deployed ❯ in the entities. In addition to these actions to strengthen the risk and control system, the Group Operational Risk Management and Permanent Control Department, the Group Compliance Department, and the Group Risk Management Department worked together on the annual internal control questionnairecampaign.The purposeof this self-assessment questionnaireis to ascertain the status of the risk control and internal control systems and their level of deployment (at both entity level and Group level) and uniformly measure the progress of the Group’s entities. This status assessmentgives rise to the development and monitoring of improvement action plans. Lastly, in addition to the Group OperationalRisk Managementand Permanent Control/Group Compliance Departments, a Research Division, reporting directly to the Group Risk Management and Control Director, completes the system; its primary responsibilities include conducting general studies on the subject of risk management and control, monitoring the emergence of new risks and tracking CRO Forum files (Chief Risk Officers – European Forum). Group General Audit Department (c) The objectives and the principles for operation and involvement of the Group’s General Audit Department and the internal audit function as well as the relationship between the various control levels (permanent control, internal audit in the Group entities and General Audit Department) are formalised in the Group internal audit policy of Groupama Assurances Mutuelles. The Group General Audit Department operates across the entire Group with a staff of 15 auditors. The Group General Audit Department’s 2020 audit plan was approved by the Groupama Assurances Mutuelles Board of Directors. The Group General Audit Department’s 2020 audit plan is organised on an annual basis around four types of missions: general audits of entities; ❯ cross-functional process audits; ❯ audits of the Groupama Assurances Mutuelles departments; ❯ spot audits at the request of the SeniorManagementor provided ❯ for in the Group procedures. Concerning the general audits of entities, the audit plan is created on the basis of a risk-basedapproach,with a three-year coverage objective for regional mutuals. Audit missions are preceded by a preliminary analysis of the risks facing the entity, in order to concentrate the audit investigations on the most sensitive areas. The audit also studies the functioning of the links the entity maintains with the Group and the other entities.

60 Universal Registration Document 2020 - GROUPAMA ASSURANCES MUTUELLES