2020 Universal registration document and annual financial report - BNP PARIBAS114

2 CorPorate GovernanCe and internal Control

2

Internal control

audit hubs based in the countries. The audit plan was thus dynamically adapted throughout the year. In total 894 missions were finally completed in 2020, i.e. 90% of the target for the year. At the height of the first lockdown, resources were also allocated to assist a few Businesses or other functions to help them cope with operational adjustments or new reporting requirements.

In 2020, the General Inspection repeated its annual Risk Assessment exercise. It was preceded by a coronavirus impact assessment. All of the nearly 3,000 Audit Units (AUs) were reviewed and a two-page documentation describing the broad outline of the AU and detailing the assessment of its inherent risk and the quality of the controls carried out therein was produced for each. In the end, the Residual Risk profile, resulting from the combination of the two previous factors, appeared to have slightly deteriorated in 2020 compared to 2019. This change is mainly due to certain effects of the pandemic on intrinsic risks, while the control system has shown good resistance, even a significant improvement in several areas of business activity. Due to the disrupted context of 2020, the General Inspection conducted during the last quarter 52 so-called Covid missions, dedicated to assessing the adaptation of the Businesses and functions during the crisis. They confirmed the general resilience of control models in the various business activities and regions.

Due to the health crisis and its consequences on its work, General Inspection reassessed and repositioned its multi-year audit plan. The purpose of this plan is to make sure the entire auditable scope is covered at the right frequency. The audit frequency for each AU is based on the residual risk score. The frequency is shorter when the residual risk measured is high. If the AU has a specific regulatory audit cycle, the applicable cycle is the shorter of the regulatory cycle and that resulting from the Risk Assessment. All the AUs were placed in order of priority by combining these different elements. The duration of the audit cycle cannot exceed 5 years in any case. By convention, the year 2018 was considered as the first year of a five-year cycle currently in progress, which means that the end of 2022 is a deadline to cover the entire auditable scope at least once during the period. The shock of 2020 complicates achieving this objective, but it remains close to being reached at this stage, insofar as the missions from the 2020 audit plan have been

for the most part replaced by feasible missions that were in the plans for 2021 or 2022. Substitution in advance occurred. While this objective of covering the auditable scope without incurring any significant delay is therefore still a current issue, too restrictive implementation difficulties in 2021 would lead to the multi-year audit plan being spread into a few additional weeks in early 2023.

In 2020, General Inspection continued its efforts to develop the use of data in its missions. Instigated by the central team, the hubs have put in place a governance adapted to their environment based on the diversity of the businesses audited and the number of locations. A progressive program with five levels of training has been introduced and offered for the first two levels to a large number of inspectors and auditors. These training initiatives, enhancing the use cases library and the growing contribution of Data Analysts in the missions have greatly contributed to the change in audit techniques and the completion of missions remotely.

The policy of very high investment in training in other areas was also continued to enable new employees to acquire the required skills base. All employees of the function receive regulatory training with a high level of expertise or technical training related to their profiles and specialisations. In the same vein, a tool to check knowledge of methodological principles has been deployed for all inspectors and auditors. Due to the circumstances, the training system was completely reorganised between face-to-face, distance learning and e-learning in 2020, to provide for digital and classroom-based at the same time. Guidelines are being defined to capitalise on these experiences in the future.

A long-term, in-depth audit guide project was continued. 2020 saw the delivery of a dedicated global tool, which supports and rewrites some of the library of methodologies, with updating mechanisms to better support regulatory changes and the procedural framework of the Bank. This project allows for greater consistency in the audit points carried out in the various hubs around the world.

The ability of the General Inspection to fulfil all of its missions was based on average headcount very close to 1,380 FTEs in 2020, the same as in 2019 (the headcount at the end of 2020 actually declined over twelve months but the figure at the end of 2019 was a temporary peak due to an atypical level of new joiners at the very end of the year).

INTERNAL CONTROL EMPLOYEES The various internal control functions are based on the following headcount (in FTE = Full-Time Equivalents, calculated at the end of the period, and estimated for 2020):

2016 2017 2018(1) 2019 2020 Change

(2019/2020)

Compliance 3,387 3,759 4,183 4,219 4,217 0%

LEGAL 1,814 1,807 1,846 1,810 1,797 -1%

RISK 5,221 5,367 5,520 5,462 5,351 -2%

Periodic control 1,238 1,296 1,394 1,446 1,393 -4%

TOTAL 11,660 12,229 12,943 12,937 12,758 -1%

(1) The internal control workforce in 2018 does not include FHB (First Hawaiian Bank).