technicolor - 2018 Registration document

RISKS, LITIGATION, AND CONTROLS

RISK FACTORS

Cyber and physical content security GRI [103-1 Customer privacy] [103-2 Customer privacy]

To ensure that quality of services is in line with customers’ expectations, initial tests and intermediary deliveries are scheduled with customers. The Division also uses workflow management tools which help to coordinate reviews and deliveries with third parties and limit the dependencies risks. Further mitigating client dependencies, with fixed bid awards, contracts have well-structured change order provisions to allow for the negotiation of award increases or decreases if a client materially changes the project scope or scale or for creative retakes. With a network of production studios across the globe, Production Services also has the scale and technology to optimize resource allocation and utilization if a specific project requires additional resources that were not previously anticipated or if a client changes its production schedule and/or release date for a project. Attract, develop & retain creative, production and technology talents GRI [103-1 Training and education] [103-2 Training and education] Risk description The Production Services Division’s success depends on the continued involvement of creative teams in the operations, and on the skills, technical knowledge and industry familiarity of key employees. For example, some film Directors want to work exclusively with particular VFX supervisors or colorists. In addition, the technology experts are essential team members in order to improve the quality of the imaging science and improve efficiency. The departure of a key member of the Division could prevent the Division from executing its business strategy, cause the loss of key customers and have a material adverse effect on the Division’s operations, financial condition and prospects. To ensure its growth and to renew its key personal, the Division must ensure it attracts and retains the best talent. Should the Group and the Division become less attractive in the job market, the performance of the Division may be negatively impacted. Furthermore, the talent pool from which Production Services draws much of its staff is highly geographically mobile. Any material delays in the immigration process for new hires may also negatively impact the Division’s operations. Risk management To limit the impact that these risks might have, the Group and Production Services have established a set of Human Resource management and recruitment programs out of which an Employee Value Proposition for attracting talent, an annual (if not more frequently) Talent Review and Career Development Plan for high potentials and key talents have been implemented. In key locations, Production Services has developed and opened academies to attract and train new talent. With regard to immigration, the Group has established and continues to nurture longstanding relationships with local governments in order to encourage their support in facilitating the immigration process.

Risk description The secure maintenance and transmission of customer information is an essential component of the Production Services Division’s operations, as the Group is entrusted with the creation and distribution of highly sensitive content on behalf of its customers and business partners. Production Services relies on internal and external information systems and technologies (managed both by the Group and by third parties) that compute, maintain and transmit multimedia content, for example to render Visual Effects or ensure post-production digital services. The security of this information may be compromised as a result of system or control failures, inadequate or failed processes, human error, willful breaches (internal and external), cyberattacks and/or business interruptions. These events could lead to a breach in the Division’s global security protocols and sensitive assets belonging to its customers (such as major studios), may be lost, disclosed, misappropriated, altered or accessed without consent. The failure to have sufficient content security systems and protocols may cause key customers to pull work from Production Services’ facilities. Risk management The security actions related to content production networks are led by internal security teams and are devoted to the mitigation of these risks. These security actions and protocols are continuously implemented, enforced, evaluated and updated as new production facilities are built, moved or acquired, and as new technologies or threats emerge. The security policies and the use of qualified providers, equipment and software, combined with regular security assessments and penetration testing, aim to mitigate the risk towards an acceptable level. For physical security risks, a dedicated team is in charge of conducting risk assessment on all critical sites and to suggest a remediation plan for local security coordinators when needed. Technicolor security standards are continuously reviewed and updated to stay ahead of the industry. Technicolor hosts audits from various customers (including studios) and industry associations such as the Motion Picture Association of America. Overall in 2018, Technicolor supported 176 security audits, which included a combination of internal and external audits. Items identified for remediation are tracked and managed by internal teams.

3

45

TECHNICOLOR REGISTRATION DOCUMENT 2018