Société Générale / Risk Report - Pillar III

3 RISKMANAGEMENT ORGANISATION

RISK MAPPING FRAMEWORK AND STRESS TESTS

RISK QUANTIFICATION PROCEDURES AND METHODOLOGIES The Group has been authorised by its supervisory authorities: for credit risk, to use the internal ratings-based approach (IRB method) for most of its exposures to credit risk. p

Currently, the Standardised approach is used for certain selected activities and exposures. They have a limited impact on the Group’s regulatory capital. The system for monitoring rating models is operational, in accordance with applicable regulations. This system is described in detail further on in this document; for these exposures covered by the standardised approach, Societe Generale mainly uses the external ratings assigned by Standard & Poor’s, Moody’s and Fitch Ratings; for market risk, to use internal models (VaR – Value at Risk, Stressed VaR, IRC – Incremental Risk Charge, and CRM – Comprehensive Risk p Measure). These models cover almost all of the transactions involved. Only some transactions are still calculated using the standardised method; for counterparty risk on market transactions, to use the internal model since 2013 to calculate the EEPE (Effective Expected Positive p Exposure) indicator. Exposure At Default (EAD) counterparty risk has been calculated on the basis of this indicator since June 2012 for “simple” products and since December 2013 for more complex derivative products. For Group entities where the internal model has been approved, the internal model covers 98% of derivative and repo transactions. The Group uses the marked-to-market valuation method for the rest of these transactions; for operational risks, to use the Advanced Measurement Approach (AMA). p Lastly, its information systems are regularly upgraded to accommodate changes in the products processed and the associated risk management techniques, both locally (within the banking entities) and centrally (Risk Division).

RISKMAPPING FRAMEWORK AND STRESS TESTS 3.6

Group risk mapping framework The risk mapping is an annual overview of the Group’s risk identification process. Risk identification contributes to the overall assessment of the Group’s risk profile, and is used in various tasks such as the Internal Capital Adequacy Assessment Process (ICAAP). Prepared by the Risk Division under the authority of General Management, the risk map is presented annually to the Board of Directors’ Risk Committee. The aim of this approach is to estimate potential material losses for the main types of risk to which the Group is exposed, including credit, market, operational and structural risks. The risk map matches potential losses to hypothetical scenarios within defined scopes. The assessment combines expert analysis and various estimated statistical approaches using historical data. Stress tests Stress tests or crisis simulations are used to assess the potential impact of a downturn in activity on the behaviour of a portfolio, activity or entity. At Societe Generale, stress tests are used to help identify, assess and manage risk, and to evaluate the Group’s capital adequacy with regard to risks. Accordingly, stress tests are: an important indicator of the Group’s resilience and that of its p activities and portfolios, and a core component in the definition of its risk appetite; based on hypothetical or historical scenarios defined with the p Economic and Sector Reseach Department, or on historical scenarios. They are translated into impacts on the Group’s activities, taking into account potential counter-measure and systematically combining quantitative methods with an expert assessment (risk, finance or business lines);

may also rely on sensitivity analyses (single-factor or multi-factor p risk). As such, the stress test framework in place includes: an annual global stress test exercise, incorporated into the budget p process (Strategic and Financial Plan) to ensure that the Group’s profile is in line with its risk exposure tolerance in the event of an adverse scenario and to quantify the extent of deterioration in the profitability of the BUs under such a scenario. It is also incorporated into the ICAAP (Internal Capital Adequacy Assessment Process); specific stress tests by risk or portfolio type: p credit risk stress tests complement the comprehensive analysis - with a more granular approach, thereby helping to clarify the establishment of risk appetite for an array of portfolios, an activity, etc. They are also used to refine the identification, measurement and operational oversight of this risk, stress tests of capital market activities are based on historical - and hypothetical scenarios and apply to the whole Group. They are supplemented by special risk exposure stress tests based on a number of risk factors (interest rate, equities, etc.) or activities (emerging markets, etc.). A stress test limit is defined for these different risk measurements, stress tests give a picture of exposure of the value and the - interest margin of the banking portfolio to structural interest rate risk. The Group sets limits on these exposures in scenarios of yield curve changes and shifts (steepening and flattening), a stress test of employee benefits involves simulating the - impacts of variations in market risk factors (inflation, interest rates, etc.) on the Group’s net position (dedicated investments less the corresponding employee benefits). A stress test indicator is established on that indicator,

25

| SOCIETE GENERALE GROUP | PILLAR 3 - 2020