Forum on Risk Management and Internal Control in the EU PATRICE MARTEAU Secretary General October 25th, 2005

October Contents 1.Regulatory background to requirements 2.Practical implementation of requirements 3.Assurance implications of developments

1.Regulatory background to requirements

October Regulatory background to requirements August 1, 2003: Loi de Sécurité Financière (LSF) was adopted by the French Parliament with the same objective of restoring the trust of the investors in the French markets The scope of LSF is wider than SOX’s Since December 31 st, 2005, only publicly-listed companies are obliged to submit a Chairman’s Report on internal control The French financial market regulatory body (AMF) insisted on the necessity of a framework to ensure comparability amongst companies Since last June, the marketplace discussions on the internal control framework have been carried out within a working group « groupe de place », composed of the main decision making bodies (AMF, Medef, AFEP, IFACI, CNCC, etc.) About 40 French companies are currently listed in the US and preparing for SOX compliance for the publication of their annual report for 31 st December 2006

2.Practical implementation of requirements

October Practical implementation of requirements To improve corporate governance, LSF requires that the Chairman of the Board or the Supervisory Board prepares, in addition to the Board's annual management report, a separate report on the internal control procedures The statutory auditors are required to prepare, in addition to their general report on the company's accounts, a separate report presenting their comments on the Chairman’s report on the internal control procedures of the company

October PPR Case study Objectives To respond to the new requirements of the French Financial Security Law To improve the overall internal control, thus contributing to an improved management of the operations To improve overall efficiency To provide a sense of responsibility to the operating personnel on their role with respect to internal control and to share best practices Scope The entirety of the processes of the company (and not only on the accounting and financial aspects), in accordance with LSF 2.Practical implementation of requirements

October PPR Case study Internal implementations Self-assessment on 13 processes Questionnaires by process and interviews for self-assessment: from 79 people in 2003 to 199 people in 2004 (executives, CFOs, operational managers, etc.) in the main subsidiaries “Evaluation” on key controls relating to 3 key processes in 2004 Construction of flow-charts presenting the principal steps and controls in the key processes selected by the CEO of each division and test of the existence and the design of the key-controls Results A new management tool A comprehensive description of internal control procedures A first degree of evaluation… 2.Practical implementation of requirements

3.Assurance implications of developments

October We can consider that a financial statement audit opinion provides adequate assurance to investors in respect to internal controls over financial reporting A full audit requirement should not be necessary at this stage The main priority is the establishment of a common framework to analyse risk management and internal control procedures 3.Assurance implications of developments

October