2018 Registration document and annual fi nancial report - BNP PARIBAS106

2 CORPORATE GOVERNANCE AND INTERNAL CONTROL

2

Internal Control

The Risk Function continued to evolve its organisation to provide optimal support for the Group s transformation. This is refl ected in particular by increased industrialisation, particularly with the development of shared operational platforms in Lisbon and Mumbai. Risk also contributed to the end-to-end review of customer processes in order to optimise them, whilst ensuring that the control system was at the highest level. Moreover, initiatives were launched with innovative companies ( fi ntechs ) to incorporate new technologies into our credit granting and monitoring processes.

In 2019, the main projects of the Risk Function will be:

■ the delivery and first phase roll-out of the new operational risk information system in the business lines and functions, and the support of operational entities as part of this roll-out;

■ work on finalising the implementation of the Third Party Risk Management system;

■ strengthening the system around business continuity and crisis management, especially for aspects relating to technological risks;

■ continued deployment of Risk s mission as the second line of defence for ESG risk management;

■ supporting the transformation of the Group s business by evolving its own processes and integrating new relevant technologies to further advance the Group s risk management system;

■ the implementation of new sites and/or projects enabling the Group to fully meet the expectations of its regulators and supervisory authorities.

Risk management related to climate change

Since the November 2015 Paris Agreement, the BNP Paribas Group has taken a number of steps to integrate climate change risk management and to support energy transition in line with the 2°C trajectory.

The Group has strengthened its sectoral policy on coal so that it no longer fi nances the extraction of coal, whether via mining projects or via specialised coal mining companies without a diversifi cation strategy, as well as coal-based power plant projects.

It has also adopted a new sectoral policy on unconventional hydrocarbons. This concerns players whose main activity is the exploration, production, distribution, marketing or trading of shale gas and/or oil or bituminous sands. Projects primarily dedicated to the transportation and export of these hydrocarbons are no longer fi nanced. In addition, the Group excludes all fi nancing for exploration or gas or oil production projects in the Arctic.

Furthermore, the criteria relating to greenhouse gas emissions have been strengthened in sectoral policies and in specifi c credit policies.

Each year, the Group also calculates its fi nanced energy mix. Further information is contained in Commitment 3 described in chapter 7 of the Registration document Indicators to this effect have been included in the Risk Appetite Statement of BNP Paribas.

Other work is underway to identify the transition risks to which the Group is exposed over a larger number of industrial sectors, to measure the fi nanced emissions (scope 3), and to compare them to the 2°C trajectory.

In terms of physical risks, the Group works internally and also with external organisations to develop tools and methodologies to better assess exposure of its loan and investment portfolio to this type of risk.

More generally, the Group has taken steps to complete the climate risk management system, in order to comply with the recommendations of the TCFD (Task force on Climate-related Financial Disclosure). To this end, it has notably joined the initiative of banks under the auspices of UNEP FI to implement these recommendations in order to establish a common methodology for stress tests of climate change risks (transition risks and physical risks). The fi rst methodologies were published in April 2018 (for transition risks) and July 2018 (for physical risks).

Further information on risk management related to climate change is contained in Commitment 3 described in chapter 7 of the Registration document.

PERIODIC CONTROL In 2018, General Inspection intensifi ed implementation of Risk Assessment, stemming from the RedesIGn programme and carried out for the fi rst time in 2017. During the 2018 fi nancial year, all audit units (AUs) were reviewed again, capitalising on the achievements of the previous year: following certain methodological evolutions, the assessments covered more types of risks by AU; cross-functional analyses by Business lines / Channels were strengthened to improve consistency controls. In the end, the overall residual risk profi le appeared broadly stable in 2018 compared to 2017.

More than 900 missions were completed in 2018, or 96% of the goal for the year. Due to the methodological evolutions resulting from RedesIGn and the Risk Assessment of 2017, the missions conducted in 2018 were targeted and focused on:

■ the AUs with the highest residual risk or with a specifi c regulatory audit cycle;

■ the new AUs, including those created to cover near-shoring platforms;

■ those whose past audit coverage was found to be inadequate and needed to be completed.

General Inspection enhanced its steering system by producing a multi- year audit plan in 2018. The aim of this plan was to organise coverage of the entire auditable scope with reasonable frequency, i.e. according to the criticality of the AUs. The duration of the audit cycle cannot exceed 5 years in any case. By convention, 2018 was considered as the fi rst year of the fi ve-year cycle. The goal was therefore to cover the entire scope by 2022 at the latest.