Company: BCDRF
Filing Date: 2025-02-28
Form Type: 20-F
Source: 0000891478-25-000054
Chunk: 375

Company: Banco Santander, S.A.
Filing Date: 2025-02-28
Form: 20-F
Chunk 375
---
 is prepared in accordance with the same principles and practices as the financial statements and is as equally reliable.

Annual report 2024 340

| Contents |     | Business model and strategy |     | Sustainability statement |     | Corporate governance |     | Economic and financial review |     | Riskmanagement and compliance |

The most significant aspects we consider when closing accounts and reviewing relevant judgements, estimates, measurements and projections are:

• impairment losses on certain assets;

• the assumptions used in the actuarial calculation for employment benefit liabilities and other obligations;

• the useful life of tangible and intangible fixed assets;

• the valuation of consolidation goodwill;

• the calculation of provisions and contingent liabilities;

• the fair value of certain unquoted assets and liabilities;

• the recoverability of tax assets; and

• the fair value of acquired identifiable assets and the liabilities assumed in business combinations.

For more details on ICS reporting and governance, see section 1.5 'Internal control system' in the 'Risk management and compliance' chapter.

Internal control policies and procedures for financial IT systems

The Technology and Operations division draws up the Group’s corporate policies on IT systems that are used directly or indirectly to prepare financial statements. These systems follow special internal controls to prepare and publish financial information correctly.

The internal control policies on the following aspects are of particular importance:

• Updated and divulged internal policies and procedures for system security and access to applications and computer systems according to the duties assigned to a role, to make sure access to information is appropriate and to protect the confidentiality, availability and integrity of financial information from cyber attacks.

• The methodology we use when creating, modifying and maintaining apps follows a cycle of definition, development and testing that ensures we process financial information correctly. We have special development and security controls and data access, testing, vulnerability management, and other mechanisms. For more details on cybersecurity, see section 5. 'Research, development and innovation (R&D&I)' in the 'Economic and Financial Review' chapter.

• Comprehensive testing of applications developed based on the requirements set by a specialized development laboratory.

• We run the complete software testing cycle in a pre-production computerized environment which simulates real situations before they are rolled out. Testing includes technical and functional tests, performance tests, user-acceptance tests and pilot and prototype tests, which the entities draw up before the apps become available to end users.

• Business continuity and technological contingency plans based on corporate methodology for key functions in disasters or other events that could suspend or disrupt operations, as well as highly