Sopra Steria - 2019 Universal registration document

2 RISK FACTORS AND INTERNAL CONTROL Risk factors

The Group performs its activities in a constantly changing environment. It is therefore exposed to risks the occurrence of which may have a negative impact on its business activities, results, financial position, image and outlook. This chapter sets out the most significant risks to which Sopra Steria Group believes it is exposed. There may also be other risks, of which the Group is not currently aware or which it considered as less important when this Universal Registration Document was prepared, which could have an adverse effect on the Group, its operations, financial position, business results or share price. Sopra Steria cannot provide an absolute guarantee that its objectives will be achieved and all risks will be eliminated. The internal control and risk management system aims to identify and qualify the risks to which it is exposed, as well as to reduce their probability of occurrence and their potential impact on the Group.

Risk factors 1.

Risk mapping exercise 1.1. and methodology

their impact, after risk management measures have been implemented. They are presented by risk category. Specific mapping exercises for corruption and influence-peddling risks and risks relating to the duty of care have also been taken into account in preparing the overall mapping of risks. The results were presented Sopra Steria’s most significant risk factors are presented below. The most significant in terms of their probability of occurrence and the severity of their impact are stated first for each category of risk in the table below. For each risk factor, a description is provided explaining in what ways it can affect Sopra Steria as well as the risk management measures put in place, i.e. policies, procedures and action plans. to the Audit Committee of the Board of Directors.

The Group’s risk mapping was reviewed and updated at the end of 2019 by the Internal Control Department, with the participation of the relevant internal stakeholders and Executive Management. This risk mapping covers all internal and external risk factors and includes both financial and non-financial issues. The process helps to identify and assess risks. In particular, assessing risks involves evaluating their probability of occurrence and their likely severity on a risk scale (low, medium or high) to determine their materiality. As part of this exercise, the most significant risks for Sopra Steria are identified in terms of their probability of occurrence and the expected severity of

36

SOPRA STERIA UNIVERSAL REGISTRATION DOCUMENT 2019