Sopra Steria - 2020 Universal registration document

2 RISK FACTORS AND INTERNAL CONTROL Risk factors

SIGNIFICANT REDUCTION IN CLIENT/VERTICAL ACTIVITY ❙

Risk description In general, the overall unstable economic situation in Europe as well as possible consolidation within the various sectors, or a slowdown in the business activity of a specific client or major sector, could have a negative impact on the Group. The difficult situation in certain sectors – in particular aerospace – severely weighed down the Group’s business activity in 2020 and is likely to continue to have a material impact for several quarters, depending on the scale and duration of the health and economic crisis. To cope with budgetary pressure, a major client or even the entire sector could be forced to curtail IT investment projects, resulting for the Group in the loss of associated revenue and requiring the reassignment of the teams in place, a risk all the more difficult to manage if the downward fluctuations could not have been predicted. Main clients include Airbus Group, Banque Postale, CNAM, Crédit Agricole, EDF, the UK Home Office, the French Ministry of the Armed Forces, the French Ministry of the Economy, Finance and Recovery, the UK Ministry of Defence, the UK Ministry of Justice, Orange, the UK Metropolitan Police, the UK National Health Service, Sparda Banken, SNCF and Société Générale. In 2020, the Group’s top client accounted for 5.9% of revenue, the top five clients represented 18% and the top ten contributed 28%.

Risk management measures The Group’s policy is to maintain a multi-client and multi-sector portfolio across multiple geographical operations and sites, in particular to avoid any uncontrolled concentration risk. The Group’s strategy relating to key accounts is reviewed each year in accordance with country, business line and sector-specific strategic reviews in order to adapt this strategy to market developments. This is the object of a dedicated exercise with all concerned parties. A regular review at monthly steering committee

meetings is also organised within the Group to monitor market developments. Furthermore, swiftly implemented action plans have helped to mitigate some of the effects of a reduction in business activity, such as transferring projects to the job markets affected, reskilling of employees and limiting subcontractors. These mechanisms have been activated in order to limit the consequences of the current health and economic crisis.

MAJOR ACQUISITIONS ❙

Risk description The Group’s development strategy is based in part on its ability to identify potential acquisition targets and integrate them into its general offering, whether to supplement or improve it. Any major difficulty in integrating companies, generating the expected synergies, retaining staff of acquired entities or achieving a return on these acquisitions in future could have a negative impact on the Group’s financial results and outlook.

Risk management measures Proposed acquisitions in the process of being identified, assessed or negotiated are reviewed on a regular basis by a dedicated committee. Due diligence procedures are implemented for all proposed acquisitions in order to identify the inherent risks of the potential deal. These audits – carried out in collaboration with external advisors – concern both financial aspects and the valuation of the target, as well as operating, legal and taxation aspects, human resources, governance, compliance and business ethics, and issues relating to the environment and society.

All procedures associated with this upstream process have been revised and supplemented to create the “M&A Playbook”, which now applies to M&A and corporate venture deals. Any acquisitions are then subject to an integration programme, making it possible to anticipate and then monitor all key stages of the process from a strategic, operating, financial and human perspective. These integration policies and procedures are in addition to the “M&A Playbook”.

ATTACKS ON REPUTATION ❙

Risk description Given its size, multiple geographical locations and positioning in projects at the heart of the clients’ information systems and more visible projects for end clients (e.g. platform activities in the United Kingdom, major public sector transformation projects, payroll outsourcing activities), the Group could become increasingly exposed to the spreading of negative information in the media, whether proved or not, stemming from media attacks by external or internal stakeholders or negative comments on social media. If the Group were to be the object of damaging media coverage or negative messages, this could have an adverse impact on its image and attractiveness and have repercussions on its financial performance. Risk management measures The Group has set up a media monitoring system in order to be should spread widely, crisis communication procedures may also be informed as soon as possible of any publications about it and be activated with the support of specialist agencies. able to react. If any criticism of or allegations against the Group

38

SOPRA STERIA UNIVERSAL REGISTRATION DOCUMENT 2020