Laís Bertoncello Email and Phone Number

Responsible to ensure compliance over global financial reporting framework, SFCF (Sandoz Financial Controls Framework), adapting it locally based on specific market requirements (risk assessment).Functional report to Regional Internal Control (GCC) located in Mexico for deliverables and strategy alignments.Coordination of local controls review (Walkthrough, Test of Design and Test of Effectiveness) with Hyderabad (India) team.Management and control owners business partner by performing communications and training over COSO / SFCF methodologies.Monitor and support control deficiencies to mitigate or eliminate risks.Ensure correct fulfillment and submission of controls information in reporting systems.Support internal, external audit and regional reviews.Support SOD and BCA risk monitoring, performed by Hyderabad team.Responsible for consolidating and present the Internal Controls Representation Letter (SOX404 equivalent) to the CFO.

Monitor internal controls environment by supporting local management to implement best practices on corporate governance, guided by Global framework NFCM (Novartis Financial Controls and Compliance).Evaluate controls efficiency throughout tests and reviews.Follow up controls performed outside the country (Mexico and India) bringing visibility to local leadership.Monitor and support identified controls deficiencies to mitigate or eliminate financial risks.Ensure correct fulfillment and submission of controls information in reporting systems.Support internal, external audit and regional reviews.Jointly monitor with Compliance function exceptions to Policies & Procedures to define corrective actions.Support SOD and BCA risk monitoring, performed by Hyderabad team.

Governance; Operational Controls; Regulatory Controls; Action Plans; Culture & Training; Continuous Monitoring (SOD included) and Policies & Procedures.Internal Control focal point for Information Security & Data Privacy; IT Department and Property Department (Real Estate & Assets).Projects:[2021] Rebates Campaign by the Group (France), the first assessment specifically related to commercial discounts: 50 rules assessed, presented, and reported to the Group.[2021] Segregation of Duties (SOD) Project to map users access with possible violation scenarios, mitigate risks identified and define compensatory controls for 14 systems in scope with financial impact, SAP included – supporting the GRC (SOD matrix) implementation. Responsible to present the project status to the CFO.[2021] Property – Real Estate & Asset: New model of Risk Committee to identify and treat high risks. Support the team to increase process Governance.

Lead the team for timely report the Global Internal Control Framework to the Group: Self-Assessment, Test of Design, Test of Effectiveness and Action Plans follow up. External Audit focal point for alignments and follow up.Policies & Procedures monitoring of local and global documents supporting Internal Control Business Partners to keep on track - on review and overdue documents;Delegations of Authorities: maintain local approval limits defined by the Organization;Segregation of Duties: maintain local SOD risks and mitigation controls on track, according to the Organization guidelines; perform manual SOD risks mapping between NOVA (SAP BR) and SODIUM (Industrial SAP);Lead Responsibility Committee (comprised by Compliance Head, Legal Head, HR Head, Internal Control Head and CFO), to evaluate deviations identified and define corrective or disciplinary actions.Projects[2019] User Project Leader (UPL) in the implementation of NOVA tool (new GRC version) for SAP system to ensure the segregation of duties (SOD) in the access management process.[2020] Internal Control & Processes Champions Program (Latam) – Increase local Internal Control culture by facilitating communication and developing experts among Sanofi departments. Higher exposure within Latam Region (bi weekly touchpoints).

Conduct Self-Assessment, tests of design and effectiveness, performed follow up and implementation of action plans.Policies & Procedures: Support business units to formalize local processes and controls according to global policies and guidance.Segregation of Duties: Maintain local SOD risks and mitigation controls on track, according to the Organization guidelines. Perform annual access review for SAP system. Projects[2017] Support the local Workday launch vs. integration with GRC tool: Workday tool has the employee’s information that it’s linked with the GRC tool to ensure an automatic access management (new access or modifications) process.[2017] Massive review (Policies & Procedures) – review SOPs according to the “One Sanofi” concept and merge documents related to the same topic or department in one (optimize and decrease number of local documents), also review documents content according to the concept “Keep it Simple” and add or remove topics according to Global documents.[2017] Specific assessment on Business Support Department focusing on sales force, samples distribution and promotional materials process – to identify gaps and define feasible action plans.[2017] Participated on the Lean Project from Business Support team to simplify the process related to sales force bonus and samples distribution, ensuring Internal Controls requirements.[2018] Quadrant Project to review and reorganize SAP system job roles per area and functions, focusing on segregation of duties (SOD) conflicts.[2018] T&E monitoring performing risk classification of deviations related to reimbursement (Concur) process and high risks identified for action or correction.

Annual activities in order to generate SOX letter: self-assessment, tests and reports.Follow up and implementation of action plans in order to attend internal controls requirements defined by the Organization.Support to business and functions to comply with internal controls requirements:• Management of internal policies and procedures.• Management in segregation of duties process.• Formalization of local approval limits defined by the Organization.Support in internal and external audits.Provide trainings: Risks & Internal Controls and Segregation of Duties.Collaborating with other Compliance functions to review over reputational risk areas (e.g. promotional practices, bribery, fair competition, code of conduct, interactions with customers and HCPs, etc.).External Assignments: [2014] Support Novartis Chile’s Controls Self-Assessment.[2015] Support during Internal Control’s Regional review in Peru.[2016] Participated as Internal Audit Guest in Costa Rica.

Support in management of access profilesSupport in management of business risk and process review:• Adequacy to the Resolution CNSP nº168 from SUSEP• Elaboration of formal notebook for application to Basiléia II• Process optimization in agreements with suppliers and third parties• Elaboration of technical guide to insurance operation’s system• Legal procedures review focusing on possible financial losses• Map of actual scenario and elaboration of improvements proposal in process and systems related to Guarantees and Legal Deposits

Internal Control and Risk Department