Introduction

Scope of application

Compliance program

Protection of whistleblowers

Audit and sanctions

Rules arising from the Sapin II Law

EU law

French law

Rules derived from competition law

Sapin II Law/Competition

Scope ratione personae

Scope ratione materiae

Scope

Development of plan

Measures included in plan

Inclusion in management report

Vigilance plan

Injunctions

Civil liability

Sanctions

Duty of vigilance (devoir de vigilance)

CSR programs

Reporting

Communication

Reporting and communication

Judicial sanctions

Risk to reputation, strategy and stability

Corporate Social Responsability (CSR)

Middlenext Code

IFA Corpus

AFEP - MEDEF Code

Types

Principles of governance

Principles incorporating CSR values

Principles

Comply or explain

Binding force

Private codes of conduct

Compliance

In accordance with Article L. 225-102-4 of the Commercial Code, the first step to be included in the vigilance plan is a risk map designed to identify, analyze and prioritize the risks generated by the company's business operations. This mapping forms the basis for the various actions to be taken going forward . 
The aim of the process is to identify and analyze the potential impact of the firm's  …

Defining and prioritizing risks

In accordance with Article L. 225-102-4 of the Commercial Code, the first step to be included in the vigilance plan is a risk map designed to identify, analyze and prioritize the risks generated by the company's business operations. This mapping forms the basis for the various actions to be taken going forward . 

The aim of the process is to identify and analyze the potential impact of the firm's activities on the fundamental rights of individuals, health and safety and on he environment by taking into account specific factors along the entire value chain that are likely to give rise to risks, such as the sector and nature of the business, its location, the type of business relationship and the legal framework underpinning it, the size, structure or resources of subsidiaries or partners, and the material conditions of production or of provision of services . Each undertaking must draw up its own risk map which is specific to it and cannot therefore be transferred, as is, to another institution.

Mapping must establish a hierarchy of risks according to their degree of severity. While the law does not go into further detail, it is useful to refer to UN Guiding Principle 24, which states that “where it is necessary to prioritize measures to address potential adverse impacts on human rights, enterprises should first seek,to prevent and mitigate those that are most severe or where delayed response would make them irremediable”.

The first major ruling on the merits of a case under Article L. 225-102-4 of the Commercial Code held that a risk mapping does not comply with legal requirements when the undertaking ranks risks as they stand after the application of measures already applied by the group, according to their severity, where such a procedure had the effect of significantly relativizing the actual implications of the undertaking's activity and, consequently, of leveling all “net” risks at a level of low intensity, without sufficiently highlighting priority vigilance areas . Similarly, a risk map that describes risks at a very high level of generality and fails to identify the specific risk factors linked to the business and its organization that could undermine protected values, does not comply with the requirements of Article L. 225-102-4 .

The French Anti-corruption Agency - AFA) has published guidelines  on anti-corruption risk mapping which can easily be adapted to the duty of vigilance, subject to adjustments to reflect the different aims of the two systems. The AFA points out that drawing up such a map requires extensive knowledge of the undertaking and its activities. This knowledge is a prerequisite for a detailed analysis of processes, and provides reasonable assurance that the mapping accurately reflects the risks to which the undertaking is actually exposed when interacting with third parties.

 The AFA also recommends that the roles and responsibilities of all relevant players at all levels of the undertaking should be identified, and that risk mapping should be comprehensive, formalized and upgradeable. To be complete, it must first cover the managerial, operational and support processes put in place by undertakings as part of their interactions with third parties. Secondly, it must cover the undertaking's scope of intervention, taking into account the risks inherent in the activities of any undertakings audited, as required. As a formalized process, it must take the form of written, structured documentation, describing in detail the methods used to produce it, the measures taken to control risks, and the roles and responsibilities of the various parties involved. Depending on the undertaking's activities and organization, it may be organized by business line, process, entity or geographical area. Last but not least, since undertakings are not static, a good risk map needs to reassess risks whenever there are significant changes within the company.

In its guide, the AFA describes a six-step process for drawing up a risk map. The first consists in identifying the roles and responsibilities of each of the stakeholders, from the management body to the compliance department and staff members. The second is to identify all the risks inherent in the company's activities, by taking stock of pre-existing risks and discussing new ones with operational staff. The third stage consists in assessing raw risks. This involves assessing the company's degree of resistance to each risk before applying any control measures, using indicators such as impact, frequency and aggravating factors. The next step is, logically enough, a residual risk assessment stage, during which the company determines the “net” risks after assessing the degree of risk control. During the fifth stage, the company prioritizes the net risks and draws up the corresponding action plan, detailing its timetable, implementation and follow-up. Finally, the sixth and last stage marks the formalization, updating and archiving of the risk map drawn up during the previous five stages.

While there is nothing to prevent the parent company and principal from having access to a detailed confidential risk map, enriched with figures for each operational unit, the published version must enable the public and stakeholders to know the precise identification of risks to human rights, health and safety, and to the environment .

The CS3D directive  provides for a procedure similar to risk mapping. In effect, it requires Member States to ensure that undertakings take appropriate steps to identify actual and potential adverse human rights and environmental impacts arising from their own activities or those of their subsidiaries and, where linked to their value chains, from their well-established business relationships. It specifies that when undertakings provide credit, loan or other financial services, the identification of actual and potential negative impacts on human rights and negative impacts on the environment should only be carried out prior to the provision of the service. For the purposes of identifying negative impacts on the basis of quantitative and qualitative information, as applicable, undertakings must be allowed to use appropriate resources, including independent reports and information gathered under the complaints procedure. Where appropriate, undertakings should also consult with potentially affected groups, including workers and other stakeholders, to obtain information on actual or potential negative impacts.

TJ Paris, 5 December 2023, LawLex202300014265JBJ, holding that the mapping of business risks, which constitutes the first stage in drafting the vigilance plan, is of fundamental importance, as its findings determine the subsequent stages and therefore the effectiveness of the entire plan.

AFA recommendations to assist public and private legal entities in preventing and detecting corruption, bribery, misappropriation of public funds and favoritism,  4 December 2020, published in the JORF of 4 January 2021.

TJ Paris, 5 December 2023, LawLex202300014265JBJ, see above.

Directive No 2024/1760 of the European Parliament and of the Council of 13 June 2024 on corporate sustainability due diligenceand amending Directive (EU) 2019/1937 and Regulation (EU) 2023/2859, OJ L of 9 Feb. 2024.

Compliance

111. Defining and prioritizing risks

Demandez un accès gratuit
au contenu exclusif Livv – juristes d’entreprise

Les décisions de justice citées dans ce paragraphe :

Les notions juridiques connexes

111. Defining and prioritizing risks

Demandez un accès gratuit au contenu exclusif Livv – juristes d’entreprise

Les décisions de justice citées dans ce paragraphe :

Les notions juridiques connexes

Demandez un accès gratuit
au contenu exclusif Livv – juristes d’entreprise