2007 REGISTRATION DOCUMENT

2 ReportCORPORATE GOVERNANCEof the Chairman of the Board of Directors on the conditions for the preparation and organisationof the work of the Board and on internal control procedures implemented by BNP Paribas< Contents >particularly in cases where delays had occurred in transposing theDirective into local legislation. The Compliance function was involvedin over 180 projects to introduce the best practices and organisationalprocedures required under the MiFID Directive and the resulting overhaulin the financial markets.Regarding financial security, the Group introduced more stringentguidelines concerning embargos. These reflected internationaldevelopments but they were bound up with more than just strict legalobligations – the Group is also aware of the constant need to protectits reputation. Reputation risk is now controlled via a framework ofappropriate guidelines and organisation procedures.The procedure for preventing and detecting market abuse is now up andrunning in line with regulatory requirements.The Compliance function and the General Inspection unit also carriedout a review of fraud prevention, detection and oversight proceduresin liaison with the core businesses and support functions to boosteffectiveness in this area still further.Lastly, know-your-customer procedures remained a key issue for allCompliance function teams.Compliance teams continued to develop important software tools toassess and manage compliance risks These tools are expected to playan increasingly significant part in the organisation and oversight ofCompliance work, as well as in Permanent Control processes.Permanent ControlsIn May 2007 in order to bolster synergies, the teams dedicated topermanent control, operational risk monitoring and business continuityplanning were merged into the Permanent Control-Operational Risk(PC-OR) entity. This merged structure has been enshrined in a Charterwhich sets out its roles and responsibilities and provides for a unifiedstructure at all operating levels of BNP Paribas. PC-OR is thereforerepresented at Group, core business, function, business line, subsidiaryand territory level. At Group level, it has dual operational lines of reportingto the Head of Compliance, responsible for coordinating Internal Control,and the Head of Risk Management.PC-OR strives to involve the Heads of the operating units in thepermanent control process by presenting topics relating to permanentcontrols, operational risk and business continuity planning to theExecutive Committee of BNP Paribas three times a year and on a periodicbasis to the monthly meetings of the ICCC. Entities are encouraged todevise their own permanent control structures.PC-OR engagements have a dual measurement/management objective:defining, coordinating and monitoring permanent control procedures andoperational risk management throughout the Group; and measuring riskand producing the related management information. This process allowsPC-OR to keep abreast of changes in the internal control environmentand to tailor internal control processes in the Group’s businesses. Toensure that it operates effectively, Group PC-OR has structured itsactivities around five key tasks: defining its processes, developingappropriate methodologies, designing and maintaining support tools,measuring risk and producing the related management information,and monitoring the processes.In 2006, BNP Paribas set up a dedicated Permanent Control reportingprocess in the form of a set of indicators. For each entity, these indicatorssummarise the following information: the operational risk incidents thathave arisen within their scope of control; identification and evaluation ofthe existing body of procedures and controls based on the risk to whichthe entity is exposed; an overview of the effective implementation ofthe controls as well as control follow-up procedures; and, a summary ofthe recommendations of the General Inspection unit that still have notbeen implemented after the recommended timeframe. It is accompaniedby a summary for each entity listing an overview of the improvementsmade to the Internal Control system in 2007 as well as the priorities thatwill underpin the action to be taken in 2008. The summary is preparedusing a “bottom-up” approach by PC-OR operational staff throughoutall Group entities: the information collected is consolidated at the nextreporting level, and so on up to Group level. At each stage of the reportingconsolidation process, management receives feedback which it validates,particularly at PC-OR Committee meetings.The information is gathered in the reporting process based on amethodological framework defined at Group level that sets out reportingguidelines and the format for deliverables.The Heads of PC-OR at core business/function and Group level exchangeinformation as part of the reporting consolidation process. Once thisiterative process has been completed, the summaries for each corebusiness/function are validated by the Heads of the correspondingentities and consolidated in a document presented to the Internal ControlCoordination Committee, Executive Management and the ExecutiveCommittee. The final part of the process consists of a submission by theInternal Control, Risk Management and Compliance Committee to theBoard of Directors of BNP Paribas.In 2007, after a year in which the scope of the Permanent Controlreporting process was greatly extended, the quality of the deliverableswas a testament to its successful Group-wide roll out. The Group wasauthorised to use the advanced operational risk measurement approachwithin the scope of the new Basel II capital adequacy regulations.In 2008, the Group will focus on building on the progress already madein the area of Internal Control to take the process to the next level. Theaim will be to enhance the operational risk management and internalcontrol processes amid increasingly standardised methods and closercoordination between PC-OR teams.Periodic ControlsThe new organisational structure of the General Inspection unit becamefully operational in 2007: it now includes internal audit staff and allgeographical and business line platforms. This global, streamlinedstructure enables the unit to provide more effective Group-widecoverage, promotes the pooling of best practices and knowledge sharingand facilitates more effective risk management control at Group level.It implemented a single, standard risk-assessment application for theentire Group, which allows it to plan audit engagements by takinginto account the risk weightings applicable to the various entitiesconcerned.It reviewed its “Recommendations” process which will be enhanced viaa workflow tool shared with auditees.The Periodic Control function also continued to invest in auditor skillsdevelopment by providing additional training and strengtheningspecialised teams (IT, accounting and financial markets/models).1234567891011582007 Registration document - BNP PARIBAS