SpareBank 1 Østlandet : UNEP FI Principles for Responsible Banking Independent Auditor's Assurance Report

Deloitte AS

Dronning Eufemias gate 14

Postboks 221 Sentrum

NO-0103 Oslo

Norway

Tel: [phone]

Fax: [phone]

www.deloitte.no

ISAE 3000 (Revised) independent limited Assurance Report to the Management on SpareBank 1 Østlandet's Reporting and Self-assessment Template under the United Nations Environment Program Finance Initiative Principles for Responsible Banking ("PRB") Framework for the year ended 31 December 2022

SpareBank 1 Østlandet engaged us to perform an independent limited assurance engagement in accordance with the International Standard on Assurance Engagements 3000 (Revised) Assurance Engagements Other than Audits or Reviews of Historical Financial Information ("ISAE 3000 (Revised)"), issued by the International Auditing and Assurance Standards Board ("IAASB").

Scope of our work

The requirements for the preparation and publishing of Selected Information within a Reporting and Self-Assessment Template in respect of the Principles for Responsible Banking "PRB" Framework are established by the Guidance for banks (February 2021)and Reporting and Self-AssessmentTemplate (September 2022)("guidance") published by the United Nations Environment Program Finance Initiative ("UNEP FI") and the Company's Basis of Reporting prepared by the Management (together the "Applicable Criteria") The guidance requires the directors of SpareBank 1 Østlandet to obtain a limited Assurance Report on the following discrete elements of the entity's Reporting and Self-Assessment Template:

• Principle 2.1: Impact analysis.
• Principle 2.2: Target setting.
• Principle 2.3: Plans for target implementation and monitoring.
• Principle 5.1: Governance and culture - describe relevant governance structures, policies and procedures.

The Selected Information for SpareBank 1 Østlandet is presented on pages 5-20 and 25-26 in the published PRB Reporting and Self-Assessment Template of SpareBank 1 Østlandet for the year ended 31 December 2022.

The guidance requires SpareBank 1 Østlandet to publish other information within its Reporting and Self-Assessment Template. This other information is not the subject of this Assurance Report.

Our approach

We planned our engagement in accordance with ISAE 3000 (Revised) and designed procedures to obtain sufficient appropriate evidence to express an independent limited assurance conclusion on the Selected Information in line with ISAE 3000 (Revised). Our procedures were informed by the Guidance for assurance providers - Providing limited assurance for report - Version 2 (October 2022)published by UNEP FI in November 2022. However, we have performed the procedures as outlined in the 'work performed' section below which do not necessarily obtain the confidence level as outlined by UNEP FI's Guidance for assurance providers, but what is normally obtained by a practitioner in a limited assurance engagement under ISAE 3000 (Revised).

We are required to plan and perform our work to address the areas where we have identified that a material misstatement of the description of activities undertaken in respect of the Selected Information is likely to arise. The assessment of what is material is a matter of professional judgement and includes consideration of both the amount (quantity) and the nature (quality) of misstatements. The procedures we performed were based on our professional judgment.

To achieve limited assurance, ISAE 3000 requires that we review the processes, systems and competencies used to compile the Report, on which we provide limited assurance. It does not include detailed testing of each of the indicators reported, or of the operating effectiveness of processes and internal controls.

Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited ("DTTL"), its global network of member firms, and their related entities	Registrert i Foretaksregisteret
(collectively, the "Deloitte organization"). DTTL (also referred to as "Deloitte Global") and each of its member firms and related entities are legally	Medlemmer av Den norske Revisorforening
separate and independent entities, which cannot obligate or bind each other in respect of third parties. DTTL and each DTTL member firm and	Organisasjonsnummer: 980 211 282
related entity is liable only for its own acts and omissions, and not those of each other. DTTL does not provide services to clients. Please see
www.deloitte.no to learn more.
© Deloitte AS

Penneo document key: WSQX3-1KXIZ-B7WOO-PHYCE-VP4H2-6CT0W

As this is a limited assurance engagement, the nature, timing and extent of evidence-gathering procedures was more limited than for a reasonable assurance engagement, and therefore substantially less assurance is obtained than in a reasonable assurance engagement.

Work performed

In carrying out our limited assurance engagement on the description of activities undertaken in respect of the Selected Information, we performed the following procedures to obtain sufficient appropriate evidence in order to express our independent limited assurance conclusion on the Selected Information:

• We planned our procedures which were informed by the Guidance for assurance providers - Providing limited assurance for report - Version 2 (October 2022)published by UNEP FI in November 2022, considering SpareBank 1 Østlandet's stage of implementation of the Principles for Responsible Banking.
• We conducted interviews with process owners and internal stakeholders to understand the processes for measuring, reporting, and presenting information in SpareBank 1 Østlandet's Reporting and Self -assessment Template, in accordance with the Applicable Criteria.
• We made inquiries with process owners and internal stakeholders, obtained and reviewed source documentation to assess whether disclosures within the Selected Information in SpareBank 1 Østlandet's Reporting and Self -Assessment Template reflect SpareBank 1 Østlandet's assessment of the stage of implementation of the Principles. Our review of source documentation did not include any detailed testing or procedures to verify the correctness and completeness of the information. We did not evaluate the design of particular processes and internal control activities or obtained evidence about their implementation or test their operating effectiveness.
• In respect of Principle 2.1 (Impact analysis), based on inquiries made and information obtained and reviewed, we checked that SpareBank 1 Østlandet's business areas and scope are clearly described. We reconciled portfolio composition to management information and checked that challenges and priorities have been analysed, including the rationale for business areas where the analysis was not performed. We also checked that SpareBank 1 Østlandet has disclosed the method for determining its impact areas and has selected what was determined as the two most significant areas of impact. For the two impact areas where performance has been measured (Climate and Resource Efficiency), we reconciled to source documentation such as published information referenced in the response and to supporting management information. Finally, we checked to source documentation, including to meeting minutes, that the stated governance process was followed.
• In respect of Principle 2.2 (Target setting), based on inquiries made and information obtained and reviewed, we checked that SpareBank 1 Østlandet sets targets for both of its significant impact areas (Climate and Resource Efficiency) and that the targets are linked to those impact areas. We checked that SpareBank 1 Østlandet has identified frameworks to align with and explained how targets contribute to relevant goals. Further, for the impact areas where targets have been set (Climate and Resource Efficiency), we checked that the base year for climate targets (2020) is no more than two full reporting years prior to the year when the targets have been set (2022) and that the targets are Specific, Measurable, Achievable, Relevant and Time-bound.
• In respect of Principle 2.3 (Target implementation and monitoring), based on inquiries made with process owners and internal stakeholders, we obtained and reviewed source documentation to assess whether disclosures within the selected responses in SpareBank 1 Østlandet's Reporting and Self -Assessment Template reflect SpareBank 1 Østlandet's assessment of the stage of implementation of the Principle.
• In respect of Principle 5.1 (Governance Structure for Implementation of the Principles), based on inquiries made and information obtained and reviewed, we checked consistency to source documentation, including organisation charts and meeting minutes with that of the disclosures of SpareBank 1 Østlandet's governance structure for implementation of the Principles. We checked that there is oversight over the implementation and monitoring and that the structure is in line with existing governance structures as defined by SpareBank 1 Østlandet. Further, we checked that the Board of Directors obtained information on the SpareBank 1 Østlandet's stage of implementation of the Principles for Responsible Banking on a quarterly basis.

Our independence and management of quality

We are independent of the company as required by laws and regulations and the International Ethics Standards Board for Accountants' Code of International Ethics for Professional Accountants (including International Independence Standards) (IESBA Code), and we have fulfilled our other ethical responsibilities in accordance with these requirements.

We apply the International Standard on Quality Management (ISQM) 1, Quality Management for Firms that Perform Audits or Reviews of Financial Statements, or Other Assurance or Related Services Engagements, and accordingly, maintain a comprehensive system of quality control including documented policies and procedures regarding compliance with ethical requirements, professional standards and applicable legal and regulatory requirements

Penneo document key: WSQX3-1KXIZ-B7WOO-PHYCE-VP4H2-6CT0W

Inherent limitations of the Selected Information

Inherent limitations exist in all assurance engagements. The Applicable Criteria, Basis of Reporting, the nature of the Selected Information, and absence of consistent external standards allow for different, but acceptable, measurement methodologies to be adopted which may result in variances between entities. The adopted measurement methodologies may also impact comparability of the Selected Information reported by different organizations and from year to year within an organization as methodologies develop.

Further, the procedures to be performed only relate to the period under review, and do not provide assurance in relation to any future period or past date as changes to systems or controls subsequent to the period covered by our report may alter the validity of our conclusion.

Our unmodified limited assurance conclusion

Based on our procedures described in this Assurance Report, and evidence we have obtained, nothing has come to our attention that causes us to believe that the Selected Information (shown over in 'scope of our work' and 'our approach') for the year ended 31 December 2022, has not been prepared, in all material respects, in accordance with the Applicable Criteria and Basis of Reporting defined by the management.

The responsibilities of the Management of SpareBank 1 Østlandet

The Management is responsible for:

• Selecting and establishing the Applicable Criteria and Basis of Reporting.
• Preparing, measuring, presenting and reporting the Selected Information in accordance with the Applicable Criteria and Basis of Reporting.
• Publishing the Applicable Criteria and Basis of Reporting publicly in advance of, or at the same time as, the publication of the Selected Information.
• Designing, implementing, and maintaining internal processes and controls over information relevant to the preparation of the Selected Information to ensure that they are free from material misstatement, including whether due to fraud or error.
• Providing sufficient access and making available all necessary records, correspondence, information and explanations to allow the successful completion of our independent limited assurance engagement.
• Confirming to us through written representations that they have provided us with all information relevant to our engagement of which they are aware, and that the measurement or evaluation of the underlying subject matter against the Applicable Criteria and Basis of Reporting, including that all relevant matters, are reflected in the Selected Information.

Our responsibilities

We are responsible for:

• Planning and performing procedures to obtain sufficient appropriate evidence in order to express an independent limited assurance conclusion on the Selected Information.
• Communicating matters that may be relevant to the Selected Information to the appropriate party including identified or suspected non-compliance with laws and regulations, fraud or suspected fraud, and bias in the preparation of the Selected Information.
• Reporting our conclusion in the form of an independent limited Assurance Report to the directors.

Use of this Assurance Report

This Assurance Report is made solely to the Management of SpareBank 1 Østlandet in accordance with ISAE 3000 (Revised) and our agreed terms of engagement. Our work has been undertaken so that we might state to the Management of SpareBank 1 Østlandet those matters we have agreed to state to them in this report and for no other purpose.

Without assuming or accepting any responsibility or liability in respect of this report to any party other than SpareBank 1 Østlandet and the Management of SpareBank 1 Østlandet, we acknowledge that the Management of SpareBank 1 Østlandet may choose to make this report available to the UNEP FI Secretariat and publicly available for others wishing to have access to it, which does not and will not affect or extend for any purpose or on any basis our responsibilities. To the fullest extent permitted by law, we do not accept or assume responsibility to anyone other than SpareBank 1 Østlandet and the Management of SpareBank 1 Østlandet as a body, for our work, for this report, or for the conclusions we have formed.

Penneo document key: WSQX3-1KXIZ-B7WOO-PHYCE-VP4H2-6CT0W

The Applicable Criteria and Basis of Reporting were designed for the purposes of SpareBank 1 Østlandet preparing and publishing a Reporting and Self- Assessment Template under the UNEP FI Principles for Responsible Banking ("PRB") Framework, and as a result the Selected Information may not be suitable for another purpose.

Oslo, 27 June 2023

Deloitte AS

Henrik Woxholt

State Authorized Public Accountant

Penneo document key: WSQX3-1KXIZ-B7WOO-PHYCE-VP4H2-6CT0W

The signatures in this document are legally binding. The document is signed using Penneo™ secure digital signature. The

identity of the signers has been recorded, and are listed below.

"By my signature I confirm all dates and content in this document."

Henrik Johannes Woxholt

State Authorised Public Accountant (Norway)

Serial number: 9578-5999-4-1368035

IP: 217.173.xxx.xxx

2023-06-28 13:42:05 UTC

Penneo document key: WSQX3-1KXIZ-B7WOO-PHYCE-VP4H2-6CT0W

This document is digitally signed using Penneo.com. The digital signature data within the document is secured and validated by the computed hash value of the original document. The document is locked and timestamped with a certificate from a trusted third party. All cryptographic evidence is embedded within this PDF, for future validation if necessary.

How to verify the originality of this document

This document is protected by an Adobe CDS certificate. When you open the

document in Adobe Reader, you should see, that the document is certified by Penneo e-signatureservice . This guarantees that the contents of the document have not been changed.

You can verify the cryptographic evidence within this document using the Penneo validator, which can be found at https://penneo.com/validator