Saint-Gobain // Universal Registration Document 2021

Risks and control Internal control

Audit and Internal Control Department

Main responsibilities

Reference standards and/or measures 2021 key figures

Internal control

Draw up and maintain the ■ Internal Control Reference Frameworks in line with the Group’s risk priorities Lead the annual compliance ■ statement process Analyze incidents, ■ self-assessments and audit results to suggest changes Monitor the implementation ■ of the action plans decided upon as a result of these exercises Communicate and train in ■ internal control

Internal Control Reference Framework ■ Standard (ICRF) Internal Control Reference Framework ■ for Information systems (ITAC) Internal Control Reference Framework ■ for companies with annual sales below €20 million (ICRF MINI) Internal Control Quality Reference ■ Framework (ICQRF) Anti-corruption internal control ■ framework (ACRF) Associated practical data sheets or ■ Group memos Internal control, risk management and ■ audit training academy (IABC Academy), part of the “Saint-Gobain University” training program accessible from the “Boost!” e-learning platform “MY ICRF” mobile app available for all ■ employees Internal Control briefs ■ Webinars and training sessions by ■ region/country (Business Control Forums (1) ) InAtranet and digital internal control ■ community on “Yammer” (“My ICRM”) Integrated Audit / Internal Control / ■ Risks tool: “INTERACT” (2) and Analysis tool: “TABLEAU” Software (3) Risks universe ■ Risks cartography ■ Methodological risk analysis tool for ■ Group companies “AVANTEAM” risk mapping tool, ■ containing the risk database Management of action plans in the ■ “INTERACT” tool Intranet and digital risk management ■ community on “Yammer” (“My ICRM”) Risks newsletter ■

1,367 action plans open in the ■ “INTERACT” database at the end of 2021 2021 compliance statement campaign ■ including the self-assessment of 224 scopes and 35 super-validations (see Section 2.5.4 - Chapter 6 - Statement of Compliance) More than 1,000 executives and ■ managers trained at four Business Control Forums (India, Latin America, Eastern countries) 31 webinars with ~ 3,000 participants ■ and 19 newsletters produced Network of 100 internal control officers ■ 75 one-to-one meetings were held with ■ Internal Control correspondents within the Group Digital Internal Control Community ■ with 1,964 members IABC training academy containing 54 ■ internal control and risk modules and two audit familiarization modules. As of December 31, 2021, Group employees

had taken 5,964 modules and 824 modules were in progress

Risk management

Define and maintain the ■ Group’s risk universe Update risk mapping at the ■ different Group levels Produce and maintain the ■ risk management methodology Analyze responses to risks ■ and the action plans for the different risks Communicate and train in ■ risk management

46 maps updated in 2021 ■ AVANTEAM risk database including ■ 566 active risks in 2021 “INTERACT” tool including 76 risk ■ action plans Updated risks universe with 13 main ■ categories and 69 sub-categories

6

SAINT-GOBAIN UNIVERSAL REGISTRATION DOCUMENT 2021 241