UNIVERSAL REGISTRATION DOCUMENT 2023

3 CORPORATE GOVERNANCE AND INTERNAL CONTROL Internal control procedures

3.5.2.2

Internal control and risk management systems within the entities and Groupama Assurances Mutuelles

(c) Monitoring of entities Every subsidiary is subject to ongoing monitoring by the departments of the division to which it is attached: Group Financial Department for financial subsidiaries; ❯ Group Insurance and Services Department for the non ‑ life insurance subsidiaries, the French service subsidiaries, and Groupama Supports & Services; ❯ Groupama Gan Vie’s Senior Management for the life insurance subsidiary and the distribution subsidiaries Gan Patrimoine and Gan Prévoyance; ❯ International Subsidiaries Department for foreign subsidiaries. ❯ This specific monitoring is supplemented at Group level by cross ‑ functional management of all of the entities, particularly in the following areas: Activity monitoring and financial reporting On behalf of the Group, the various Group Analysis and Management Control Departments (within the Group Financial Control Department) implement procedures for activity monitoring (performance indicators) and financial reporting for all regional mutuals, French and international subsidiaries, and Groupama Assurances Mutuelles. The aim is transparency of results and an understanding of trends in these areas for the Groupama Assurances Mutuelles Executive Management and the entities. This approach is based on a process of management planning that is common to all entities. It is implemented and coordinated by the Group Financial Control Department and is based on core Group standards for developing forecasts, approved by the Executive Management and updated regularly. The internal control procedures for financial reporting are specified in chapter 6 of this Universal Registration Document. In addition to this monitoring process, business reviews are conducted twice a year for Group subsidiaries in France and internationally with the Executive Management of Groupama Assurances Mutuelles. These exchanges ensure, in particular, that the Company’s strategic guidelines conform to the Group framework. These business reviews have included a specific “risk” section presenting, by entity, the level of deployment of the internal control system and the main activities under way in the area of risk management. Asset/Liability Management and investment strategy As the central body, Groupama Assurances Mutuelles is responsible for defining the Group’s investment strategy. The structuring framework of the management measures related to Asset/Liability Management and investment operations (general organisation and risk management measures) is formalised as part of the policy of the Group and Groupama Assurances Mutuelles for Asset/Liability Management and investment risk, approved by the Groupama Assurances Mutuelles Board of Directors on 26 October 2022. The Group Investment Department, within the Group Financial Department, is in charge of defining the Group investment strategy and relies on, where appropriate, the expertise of the various Group entities or Groupama Assurances Mutuelles departments:

(a) Within the entities The risk control and internal control system specific to the entities is organised around two complementary systems: risk management and internal control of each entity; ❯ internal or operational auditing of every entity. ❯ These systems are adapted to each entity based on its organisation, activities, and resources and the local regulations abroad, under the authority of its Executive Management. Regarding organisation and governance, the French entities subject to the Solvency 2 regulations have specified in their risk policies the roles and responsibilities of the administration and executive management bodies, key functions, and operational or support departments involved in risk management. As under the Group model, the entities regularly hold specialist Risk Management Committee meetings and reinforce the level of maturity of the following four key functions, defined under Solvency II: The Group Risk Management, Control, and Compliance Department supports the entities in monitoring and rolling out Group standards. The entities’ permanent control plans are integrated into the community operational risk management tool according to the Group methodology. This tool also enables collection of incidents, assessment of operational risks, and management of action plans. All of the Risk Management and Permanent Control/Compliance Managers of the Group’s entities supplement the plan and meet regularly within the framework of information exchange and best practices bodies (workgroups, theme ‑ based workshops, and training), directed by the Group Risk Management, Control, and Compliance Department. An ARCC Operation Committee (ComOp) brings together the regional mutuals and the main subsidiaries of the Group’s France scope, with regular reports to the Group Executive Committee. the “risk management” key function; ❯ the “compliance verification” key function; ❯ the “audit” key function; ❯ the “actuarial” key function. ❯ (b) Within Groupama Assurances Mutuelles Implementing the internal control system at the level of the functional and operational activities of Groupama Assurances Mutuelles is the responsibility of the various officers in charge of these activities under the authority of the Group Executive Committee. The area of responsibility of each of these Managers is determined by the delegations of authority approved. The implementation of the internal control system of the corporate entity Groupama Assurances Mutuelles is handled by an employee of the Group Risk Management, Control, and Compliance Department.

63

Document d’Enregistrement Universel 2023 GROUPAMA ASSURANCES MUTUELLES