3 SUBSIDIARY AUDIT MATRIX Type of country Sites audited All countries Factories, dispatch centres, R&D sites and administrative sites MATRIX THAT TRIGGERS SUPPLIER AUDITS ACCORDING TO RISK MAPPING Business sector Description of business sector Type of country Suppliers audited Raw materials Suppliers of ingredients used to produce cosmetics in L’Oréal factories Countries classified as “high risk” 100% of Suppliers Packaging Suppliers of packaging used for production in L’Oréal factories Countries classified as “high risk” 100% of Suppliers Subcontractors Suppliers producing cosmetics for L’Oréal (Full-buy, Full-service, etc.) Countries not classified as “high risk” 100% of new Suppliers (initial audit) When the “satisfactory” or “NCI” (Needs Continuous Improvement) rating is achieved, additional audits are no longer necessary Countries classified as “high risk” 100% of subcontractors Dermo-cosmetic devices Suppliers of equipment & electronics Countries classified as “high risk” 100% of Supplier Production Sites Manufacturing equipment Suppliers of manufacturing equipment (processing tanks, filling machines, etc.) Countries classified as “high risk” 100% of Supplier Production Sites Promotional items Suppliers of promotional items (bags,  etc.) Countries classified as “high risk” 100% of Supplier Production Sites Items intended for points of sale Suppliers of items intended for the presentation of products at points-of-sale Countries classified as “high risk” 100% of Supplier Production Sites Services intended for points-of-sale Architects, general contractors, maintenance Not applicable Not applicable Co-packing Co-packing Suppliers (sometimes  called subcontractors or Co–Packers) Countries not classified as “high risk” 100% of new Suppliers (initial audit) When the “Satisfactory” or “NCI” (Needs Continuous Improvement) rating is achieved, additional audits are no longer necessary Countries classified as “high risk” 100% of Supplier Production Sites Logistics service providers (excluding transport) External distribution centres Countries not classified as “high risk” 100% of new Suppliers (initial audit) When the “Satisfactory” or “NCI” (Needs Continuous Improvement) rating is achieved, additional audits are no longer necessary Countries classified as “high risk” 100% of Suppliers’ logistics sites L ’ ORÉAL I UNIVERS AL REGISTRATION DOCUMENT 2021 153 RISK FACTORS AND CONTROL ENVIRONMENT Vigilance Plan