Groupe Renault - 2019 Universal Registration Document

01

INTERNAL CONTROL AND RISK MANAGEMENT GROUPE RENAULT

Implementation of internal control and risk management 1.5.2 objectives

Implementation of objectives 1.5.2.1 The internal control system aims to ensure the proper functioning of the internal processes implemented through a framework of methods and procedures. The operating processes are guided by QCD (Quality/Cost/Delivery) indicators, for which the risks have been analyzed as part of the entity mapping projects, self-assessment questionnaires and performance reviews. Internal Control Each year, the Internal Control department runs an internal control campaign in which self-assessment questionnaires are sent to the Group’s main entities. The CEOs of the entities validate these self-assessments and commit to defining and implementing action plans to remedy any internal control shortcomings identified. These action plans are subject to annual monitoring by the Internal Control department. The results of these self-assessments are presented to the Audit, Risks and Ethics Committee once a year. Compliance tests are conducted on the basis of a sample of entities by the internal controllers of the Internal Control department to verify the quality of the self-assessments. Entities with lower risk levels (entities not fully consolidated or unconsolidated entities) are subject to separate internal control systems. Risk management The Group applies a risk management method based on one hand on identifying and assessing risks of any kind, which are then mapped, and, on the other hand, on carrying out action plans to deal with these risks, and specifically their net impact and/or probability of occurrence, by means of: elimination, prevention, protection or transfer. This method applies to the Group, entities, vehicle programs and global functions. The mapping of major Group risks (descending and ascending) is presented to the Risks and Internal Control Committee, the Group Executive Committee and the Audit, Risks and Ethics Committee, which validate it. The major risk factors to which the Group is exposed are described in section 1.6. To carry out its duties, the Risk Management department relies, in particular, on two networks: one comprising managers mainly from the performance and P control function, for the operating entities (countries, commercial and/or industrial subsidiaries) and global functions, and from the quality assurance function, for the programs. These managers are known as Operational Risk managers (RMO). They work with the Risk Management department on the operational implementation of risk management systems within the entities, the programs and global functions;

the other made up of experts who manage a specific area of risks. P These may be risks common to all companies or specific to one of Groupe Renault’s segments of activity. These experts are known as Expert Risk managers (RME) and consult on the standardized risk management plans in their area of expertise. To draw up the audit plan for the Company’s major risks, which is validated by Senior Management and approved by the CARC, the Internal Audit department uses risk maps to identify the most pertinent audit themes and assess risk coverage. Through its auditing task, the Internal Audit department provides the Risk Management department with insight on the effective level of control of major risks. 1.5.2.2 Internal Control The work of the Internal Control department in 2019 included: continued action to improve the corruption prevention system and P support for the operational staff affected; performance of awareness-raising actions and training in the risks P of external fraud, such as “CEO fraud” and “change in bank details fraud”; the roll-out of internal control training and of the analysis method P for the separation of tasks with standard grids for the main processes at risk; definition of preventive and detection controls based on a Data P Analytics unit; review of the rules for delegation of authority, in particular P following changes in the Group’s method of governance. The “tone at the top” in terms of internal control was reaffirmed by the distribution of a letter signed by the CFO that positioned internal control as an essential performance feature of the company. The priorities in 2020 will be to continue these underlying actions begun in previous years. Training actions The main corporate functions have set up schools to raise the professional standards of their staff. These schools reflect their strong belief in employee training as a way to enhance performance and to better satisfy Senior Management expectations. The Internal Control department has launched a program of specific and further training for operational managers within the entities, with more than 455 managers and 43 executive committees being trained over the last four years. Assessment and outlook

94 GROUPE RENAULT I UNIVERSAL REGISTRATION DOCUMENT 2019

Find out more at www.groupe.renault.com