Universal Registration Document 2019

130 LISI 2019 UNIVERSAL REGISTRATION DOCUMENT Corporate Social Responsibility 4 13  /  Report by the independent third-party organization on the consolidated social, environmental and societal information (1) ISAE 3000 - Assurance engagements other than audits or reviews of historical financial information Financial year ended December 31, 2019 Report by the independent third-party organization on the consolidated non-financial performance To the Shareholders General Meeting, As an independent third-party organization, accredited by COFRAC under number 3‑1681 (scope of accreditation available on the website www.cofrac.fr ) and member of the network of one of the auditors of your company (hereafter the entity), we present our report on the consolidated non- financial performance relating to the financial year ended December 31, 2019 (hereafter the “Declaration”), presented in the Management Report in application of the legal and regulatory provisions of Articles L. 225‑102‑1, R. 225‑105 and R. 225‑105‑1 of the French Commercial Code. Responsibility of the Entity It is the responsibility of the Board of Directors to prepare a Declaration that complies with the legal and regulatory provisions, including a presentation of the business model, a description of the main extra-financial risks, a presentation of the policies applied to these risks and the results of these policies, including the key performance indicators. The Declaration was prepared by applying the entity’s procedures (hereafter the “Guidelines”) of which the most important elements are presented in the Declaration and available on request at the entity’s head office. Independence and quality control Our independence is defined by the provisions outlined in Article L. 822‑11‑3 of the French Commercial Code and the Profession’s Code of Ethics. In addition, we have implemented a quality control system that includes documented policies and procedures to ensure compliance with ethical standards, professional standards and applicable laws and regulations. Responsibility of the independent third-party organization It is our responsibility, based on thework performed, to provide a reasoned opinion expressing a moderate assurance on: ■ the compliance of the Declaration pursuant to Article R.225‑105 of the French Commercial Code; ■ the sincerity of the information provided in accordance with 3° of I and II of Article R. 225‑105 of the French Commercial Code, i.e. the results of the policies, including the key performance indicators, and the actions relating to the main risks, hereafter the main risks, hereinafter the “Information.” However, it is not our responsibility to comment on the entity’s compliance with the other legal and regulatory provisions applicable, in particular with regards to the vigilance, anti- corruption and anti-tax evasion plan or on the compliance of products and services with the applicable regulations. Nature and scope of work The work described hereinafter was performed in accordance with the provisions of Articles A. 225‑1 et seq. of the French Commercial Code, the professional standards of France’s national audit regulatory body, the “Compagnie nationale des commissaires aux comptes,” regarding this type of audit and with ISAE 3000: (1) ■ We reviewed the activities of all entities included within the scope of consolidation and the description of the main risks; ■ we have evaluated the appropriateness of the Repositories with regards to their relevance, completeness, reliability, neutrality and understandability, taking into account, where appropriate, the industry’s best practices; ■ we have verified that the Declaration covers each category of information provided for in III of Article L. 225‑102‑1 concerning social and environmental issues as well as the respect of human rights, anti-corruption work and tax evasion; ■ We have verified that the Declaration presents the information required by Section II of Article R. 225‑105when relevant in terms of the main risks and includes, where applicable, an explanation of the reasons justifying the absence of the information required by the second paragraph of Section III of Article L. 225‑102‑1; ■ We have verified that the Declaration presents the business model and the main risks linked to the activities of all entities included in the scope of consolidation, including, when relevant and appropriate, the risks generated by its business relationships, its products or its services as well as the policies, actions and results, including key performance indicators related to the main risks; ■ We have consulted the documentary sources and conducted interviews in order to: • evaluate the selection and validation process for the main risks as well as the consistency of the results, including the key performance indicators selected in relation to the main risks and policies presented. • corroborate the qualitative information (actions and results) we deemed to be the most important presented in