Core principles of risk management at Societe Generale

The following sections outline the core principles of risk management at Société Générale. The Group’s complete policy therein is outlined in the bank’s reference document for 2008, which is available online at www.socgen.com.

Société Générale Group dedicates significant resources to constantly adapting its risk management to its increasingly varied activities. All modifications were implemented in compliance with the two fundamental principles of banking risk management, as stipulated in regulations 1997-02, 2001-01 and 2004-02 of the Comité de la Réglementation Bancaire et Financière (French Banking and Financial Regulation Committee):

- risk assessment departments are completely independent of the operating divisions,
- a consistent approach to risk assessment and monitoring is applied at a Group level.

The Group's risk function comprises some 2,700 staff dedicated to risk management activities.
The Risk Division at Société Générale Parent Company employs nearly 700 staff, while a further 2,000 are employed throughout the Group to monitor risk exposure within the French Network in the subsidiaries.
The Risk Division is completely independent from the Group's operating entities and reports directly to the General Management. Its role is to contribute to the development and profitability of the Group by ensuring that the risk management framework in place is both sound and effective. It employs various teams specializing in the operational management of credit and market risk as well as risk modeling teams, IT project managers, consultant engineers and economists.
This Division:

- defines and validates the methods used to analyze, assess, approve and monitor credit risks, country risks, market risks and operational risks;
- conducts a critical review of sales strategies for high-risk areas and permanently seeks to improve the forecasting and management of all such risks;
- contributes to the independent assessment by validating credit risk transactions and by taking positions on obligors proposed by the sales managers;
- identifies all Group risks and monitors the adequacy and consistency of risk management information systems.

A systematic review of the Bank's key risk management issues is carried out during the monthly Risk Committee meetings, which bring together the members of the Executive Committee, the heads of the business lines and the Risk Division managers.

This Committee meets to review all core strategic issues: risk taking policies, measuring methods, material and human resources, analyses of portfolios and the cost of risk, market and credit concentration limits (by product, sector, region, etc.) and crisis management.

All new products and activities or products under development must be submitted to the New Product Committee of the relevant division (sales or business line). This New Product Committee aims to ensure that, prior to the launch of a new activity or product, all associated risks are fully understood, measured, approved and subjected to adequate procedures and controls, using the appropriate information systems and processing chains.

Main banking risks
- Credit risk (including country risk): risk of loss arising from the inability of the bank's customers, sovereign issuers or other counterparties to meet their financial commitments.
- Market risk: risk of loss resulting from changes in market prices and interest rates, in the correlations between them and in their volatility.
- Structural risks: risk of loss or of residual depreciation in the bank's balance sheet arising from variations in interest or exchange rates.
- Liquidity risk: risk of the Group not being able to meet its commitments at their maturities.
- Operational risk (including, amongst others, legal and compliance risks, accounting, environmental and image risks): risk of loss or fraud or of producing incorrect financial and accounting data due to inadequacies or failures in procedures and internal systems, human error or external events.

Tailored methods and systems
Société Générale dedicates significant resources to adapting its risk management and control. Its information systems, in particular, are regularly upgraded to accommodate changes in the products processed and the associated risk management techniques, both at local level (banking entities) and centrally (Risk Division).
In the case of counterparty risk on marketable products, the existing methods used to measure exposure are backed up using stress tests to reinforce the transaction selection process.
With respect to market risk, the current measurement model used internally (VaR) has been approved by the French Banking Commission for nearly all transaction types.
In credit and operating risk, risk approval and monitoring procedures have been reinforced and adapted to take account of the regulatory requirements associated with the implementation of Basel II. 2007 represented an important stage for the Group in terms of IRBA (Internal Rating Based Advanced) and AMA (Advanced Measurement Approach) validation. The French Banking Commission carried out a detailed review of the main portfolios and the operating risk monitoring system. All the supervisor’s recommendations following these audits were dealt with within the prescribed timeframe enabling the Group to obtain IRBA and AMA validation from January 1, 2008.
In the case of credit risk, the modeling work carried out was accompanied by the implementation of sustainable processes in the Group enabling the collection of necessary data.
This approach will supplement the economic capital, risk-adjusted return on capital (RAROC) and economic value added (EVA) indicators introduced by the Group in recent years. However, adapting these methods requires considerable resources to model the Group's activities and modify the information systems accordingly. These models are a tool to help in the decision-making process for the approval and pricing of loans and will serve as a basis for the calculation of capital requirements in respect of credit risk in accordance with Basel regulations.
In the case of operating risk, the system has now entered the production phase. The AMA system incorporates the collection of internal loss data and scenario analyses making it possible to regularly present simulations for the calculation of regulatory capital requirements allocated to operating risk to the Risk Committee in order to monitor the main developments in Group Capital.

Key figures in risk management
Loans to non-banking customers including individuals in 2007 (on- and off-balance sheet commitments, excluding repurchase agreements): EUR 461 billion
84% in major industrialized countries (of the remaining 15%, 9% of commitments concern Eastern Europe)
29% of off-balance sheet commitments
Risk provisioning in 2007: EUR 905 million (i.e. 25bp of risk-weighted assets)
Non-performing loans: 3.5% of customer loans, 59% of which are covered by provisions
Average trading VaR¹ in 2007: EUR -46 million
2,700 employees dedicated to managing and controlling risk exposure on a permanent basis