Sopra Steria - 2018 Registration document

INTEGRATED PRESENTATION: SOPRA STERIA Risk management RISKMANAGEMENT

INTERNAL CONTROL AND RISK MANAGEMENT SYSTEM STAKEHOLDERS

Board of Directors / Audit Committee

Executive Management

2 ND LINE OF CONTROL Departments Finance Industrial Human Resources Legal Sustainable Development and Corporate Responsibility

1 ST LINE OF CONTROL Operational Management All entities All geographies All activities

3 RD LINE OF CONTROL Internal Audit

External Audit

Internal Control and Risk Management Department

The Group’s risk mapping exercise covers all internal and external risk factors and includes both financial and non-financial issues. In particular, the assessment of risks involves an evaluation of their probability of occurrence and the estimated magnitude of their adverse impact should an event occur (low, medium or high). As part of this exercise, the main risks are identified, namely the ones that are most significant for Sopra Steria, in terms of probability of occurrence and the expected magnitude of their impact. They have been ranked by category of risk. IDENTIFICATION OF THE GROUP’S MAIN RISKS

MAIN OPERATING RISKS

The aims of the internal control system and the risk management policies put in place by the Group are to reduce the probability of occurrence of these main risks as well as their potential impact on the Group. Chapter 1 of this document includes a detailed description of each of these risks, including the ways in which they are addressed by the Group’s risk management policies.

Risk related to market developments and the transformation of the business model

Risk related to the adaptation of skills*

Risk related to the protection and security of client data

Risk related to project delivery

Risk related to continuity of service and information system security

Risk related to attracting and retaining talent*

Risk related to the loss of a significant client

Risk related to activities in high-risk countries

Risk related to Brexit

Risks associated with retirement benefit obligations

MAIN NON-FINANCIAL RISKS

Risk of breaches of ethics or violations of the law*

* This risk also meets the requirements of the regulations set out in Articles L. 225-102-1-III and R. 225-105 of the French Commercial Code.

See Chapter 1 for more information

10

SOPRA STERIA REGISTRATION DOCUMENT 2018