Company: BCDRF
Filing Date: 2025-02-28
Form Type: 20-F
Source: 0000891478-25-000054
Chunk: 378

Company: Banco Santander, S.A.
Filing Date: 2025-02-28
Form: 20-F
Chunk 378
---
 requirements;

• the reliability and integrity of financial and operational information; and

• asset integrity.

Its scope of action includes:

• all entities over which the Group exercises effective control;

• separated assets (for example, mutual funds) managed by the entities mentioned in the previous section; and

• any entity (or separated assets) not included in the above points with which the Group has entered into an agreement to provide internal audit function.

This subjective scope includes, our activities, businesses and processes (performed internally or through outsourcing), the organization and, where applicable, branch networks. Internal audit function may also conduct audits for other investees that are not included in the preceding points when the Group has reserved this right as a shareholder, as well as on outsourced activities in accordance with the established agreements.

The audit committee supervises the Group's Internal Audit function. For more details, see section 4.5 'Audit committee activities in 2024' .

As at 2024 year-end, Internal Audit division had 1,230 employees, all exclusively dedicated to this service. Of these, 281 were based at the Corporate Centre and 949 in the local units located in the Group´s core markets, all with exclusive dedication.

Every year, the internal audit function prepares an audit plan based on a risk self-assessment and is solely responsible for executing the plan. Reviews may lead to recommendations, which are prioritized in accordance with their relative importance and are continuously monitored until full implementation.

In its meeting on 13 February 2024, the audit committee gave the green light to the internal audit plan for 2024, which the board of directors subsequently approved at its meeting on 26 February 2024.

The internal audit function report on the ICFR review aimed to:

• verify compliance with the provisions contained in sections 302, 404, 406, 407 and 806 of the SOx Act;

Annual report 2024 342

| Contents |     | Business model and strategy |     | Sustainability statement |     | Corporate governance |     | Economic and financial review |     | Riskmanagement and compliance |

• check corporate governance with regard to information relating to the ICFR, including risk culture;

• review the functions performed by the internal control departments and by other departments, areas and divisions that work to ensure compliance with the SOx Act;

• make sure the supporting documentation relating to the SOx Act is up to date;

• confirm the effectiveness of a sample of controls based on an internal audit risk assessment methodology