Saint-Gobain // Universal Registration Document 2021

6

Risks and control Internal control

Audit and Internal Control Department

Main responsibilities

Reference standards and/or measures 2021 key figures

Internal Audit

Entities audited every 3 to 5 years ■ depending on company size 123 audit missions, 13 special missions ■ to review executive expense reports and 31 intrusion tests conducted 174 best practice briefs published ■ (including 21 in 2021) IABC training academy containing 33 ■ audit methodology modules, access to which is restricted to Group auditors. As of December 31, 2021, the Group’s auditors had completed 950 modules and 159 modules were in progress Training week organized in ■ January 2021 for all auditors, representing 24 hours of training; Training program for newcomers ■ (Induction) organized in September 2021, representing 11 hours of training for the auditors concerned Methodological training cycle, i.e. five ■ thematic sessions scheduled for the first half of 2021 for all auditors, plus two thematic sessions on the tools (Excel, VBA)

Audit plan ■ Audit methodology ■ Specific “Essential Controls” anti-fraud ■ methodology Best practices library ■ “TABLEAU” data analysis tool ■ “CELONIS” process analysis tool ■ Management of action plans in the ■ “INTERACT” tool Internal control, risk management and ■ audit training academy (IABC Academy), part of the “Saint-Gobain University” training program accessible from the “Boost!” e-learning platform Auditor training Program ■

Conduct audits and monitor ■ the implementation of the mandatory controls required by the Internal Control Reference Frameworks Check the consistency of ■ compliance statements Carry out cross-cutting ■ studies on the operational benefit for the Group Identify and share best ■ practices

The Business Control Forums are local training sessions delivered over one or two days for executives and managers. The topics such as the (1) fundamentals of internal control and the fight against fraud, audit results and compliance statements, as well as case studies on various processes. Integrated audit and internal control tool used for the management of compliance statements, action plans and audits. (2) Intelligent data analysis and reporting tool. (3)

Functional departments 2.2.4 Compagnie de Saint-Gobain’s Corporate Directors are responsible for setting up an internal control structure and defining internal control strategies and procedures in their area. They assist the Audit and Internal Control Department in leading and conducting the internal control process in their area, notably: identify and analyze the main risks associated with their ■ internal processes;

define effective and relevant controls formalized in the ■ Internal Control Reference Framework; inform and train the employees responsible for internal ■ controls within their area; analyze any internal control weaknesses or incidents ■ and the results of internal audits. The Corporate Directors are also responsible for the internal control system within the Company entities, notably to establish the Group’s procedures.

SAINT-GOBAIN UNIVERSAL REGISTRATION DOCUMENT 2021 242

www.saint-gobain.com