DERICHEBOURG - Universal registration document 2018-2019

3

Group management report Risk factors

Risks

Risk management systems

Information technology risks

A major IT incident (hardware failure, cybercrime, etc.) could affect the Group’s activities.

The Group has a reliable IT organization based on duplicating machine rooms, tested failover plans and the regular backup of data. During the next year, the Group will prepare business recovery plans. The Group considers that the majority of its operating activities can continue for several hours in the absence of the Group’s IT capabilities.

Legal risks and development risks

For service activities, the Group may offer services that are in addition to those already offered and this may present costing and performance risks. Risk of a disagreement with a joint venture partner that could lead to a deadlock or to commitments given by the Group that exceed its share in the Company.

The Group endeavors to focus on each of its businesses so that they have sufficient size and experience to address all of their challenges.

As the Group wholly controls the vast majority of its subsidiaries, such cases are few in number. The potential risks of such situations are regularly reviewed.

Risks related to the consequences of inappropriate behavior

Risk of fraud (impersonation fraud, factoring fraud, etc.).

Initiatives to raise awareness (for accountants, transfer order signatories, etc.) of these risks, limiting the number of people authorized to work on payment flows. Implementation of the provisions of the Sapin 2 Law, in particular involving training initiatives for employees affected by these matters.

Reputational risk and risk of being banned for a period from participating in public tender processes following an irregularity in a tender process.

Liquidity risk

See note 4.11.3 to the consolidated financial statements and section 3.2.6

Foreign exchange and interest rate risk

See note 4.12 to the consolidated financial statements.

Significant ongoing litigation

See note 4.27 to the consolidated financial statements.

It manages the risk management system put in place by the Group. Its objectives are: asset protection; p the reliability of financial information; p implementing the instructions and guidelines set by the executive p body; compliance with laws and regulations; p the proper functioning of internal processes. p It enables: the Group's activities to be managed in the best possible way; p operations to be more efficient; p resources to be optimized; p the identification of risks that could prevent strategic and operating p objectives from being achieved; control and monitoring initiatives to be implemented. p The Group's internal control function has a key role. In particular, it lays down processes, formalizes procedures and monitors corrective actions. It harmonizes the operating and managerial practices of subsidiaries.

The internal control system 3.3.3 Internal control objectives 3.3.3.1

The purpose of internal control is to prevent and control risks inherent in the Company’s business and the risk of errors and fraud in the accounting and financial fields, in particular. As with any control system, it cannot provide assurance that risks will be totally controlled or eliminated. Control procedures mainly seek to ensure that managerial actions, transactions and staff behavior comply with the guidelines and rules the Company’s governing bodies have set forth to govern the Company’s business as well as the applicable laws and regulations. The purpose of these control procedures is also to ensure that the accounting, financial, legal and economic information provided to the Company’s structures and that may be provided to third parties pursuant to regulatory requirements or as part of the Group’s communication policy, is reliable and faithfully reflects the Company’s business and position. Description of the general organization 3.3.3.2 of internal control Derichebourg Group's internal control function The internal control function reports to the Secretariat General.

DERICHEBOURG p 2018/2019 Universal Registration Document 102