French Anti-Corruption Law:Is Your Company Ready for an AFA Audit?
An AFA audit starts long before the notification arrives.
For executives of groups operating in France, AFA audit preparation means being able to explain your anti-corruption programme and show how it works. Start with the legal perimeter, then examine the decisions, controls and records behind your policies.
01 / Confirm the scope
Map the entities and the basis for their inclusion in the review.
02 / Test implementation
Follow real decisions from the identified risk to the recorded outcome.
03 / Involve executives
Give unresolved issues an owner, resources and management attention.
Does French anti-corruption law apply to your company?
For corporate groups, the first check is Article 17 of the Sapin II Act. Broadly, it covers a company with at least 500 employees, or belonging to a group with a French parent and at least 500 employees, where turnover or consolidated turnover exceeds €100 million. The provision also addresses certain public industrial and commercial entities. Read Article 17.
A foreign headquarters does not automatically put French operations outside scope: a French subsidiary meeting the relevant thresholds can be covered. When an entity subject to Article 17 prepares consolidated accounts, the provision extends to its subsidiaries and controlled companies. See the AFA’s explanation of group coverage.
Since the law of 13 June 2025, certain operators of port facilities are also covered regardless of size. This is a specific extension, not a rule applying to every business working in a port. Check the AFA’s scope guidance.
What does an AFA audit assess?
An AFA audit is an administrative review of the existence, relevance and effectiveness of the anti-corruption programme. It is not conditional on a proven bribery incident. A policy library alone therefore cannot demonstrate readiness. AFA audit overview.
The AFA’s charter describes an initial examination of the programme and a possible second phase involving deeper testing. Documents and interviews help the auditors understand how the arrangements operate. The published questionnaire offers a useful starting point for preparation, but the AFA adapts its requests to the entity and its risks. Audit charter. Published questionnaire.
Use a simple internal test: select a recent business decision and trace it from the risk identified to the approval, control and recorded outcome. If that chain cannot be reconstructed, identify whether the weakness concerns the rule, its implementation or its evidence.
Start AFA audit preparation with leadership and risk mapping
The AFA’s guidelines place senior management commitment, corruption risk mapping and risk management at the centre of the programme. They are not legally binding rules in themselves; alternative methods remain possible if they deliver compliance with the law. The status of AFA recommendations.
For executives, preparation should include a review of decisions already taken: resources approved, concerns escalated, overdue actions challenged and responsibility assigned. Ask the compliance officer which issues need a management decision today. A signed statement of commitment is useful, but it does not show how a difficult issue was resolved.
Then choose one current risk scenario and ask the business owner to explain it. For example: how could an intermediary influence a public tender, which warning signs would trigger a review, and who could stop the engagement? Check whether the scenario still reflects the business after acquisitions, new markets or changes in distribution.
Keep a short record of the assumptions tested, the people consulted and the resulting changes. This makes the next review more useful than simply changing the date on the risk map.
Review the eight Sapin II measures against real evidence
Article 17 requires eight measures and procedures. The table pairs each with a practical example to examine during preparation; it is not an exhaustive list of documents the AFA will request. Article 17, section II.
| Measure | Evidence to examine |
|---|---|
| Code of conduct | Risk examples, applicable versions and evidence of communication. |
| Internal reporting mechanism | Reporting routes, access arrangements and a suitably protected handling record. |
| Corruption risk mapping | Methodology, current scenarios and the resulting priorities. |
| Customer, first-tier supplier and intermediary due diligence | A completed file, its risk assessment and the resulting decision. |
| Accounting controls | A completed control, the exception identified and its resolution. |
| Training for exposed managers and employees | Target populations, relevant content and participation records. |
| Disciplinary rules | Applicable rules and appropriately restricted evidence of their use, where relevant. |
| Internal monitoring and evaluation | Review findings, assigned actions and evidence of follow-up. |
For each item, identify the owner, the current document, a completed example and any unresolved weakness. If a record is missing, describe the gap accurately and assign a corrective action. Keep the historical record separate from improvements introduced during preparation.
Check that group policies work in French operations
A global anti-bribery policy can provide a common framework. Your preparation review should also ask whether local employees can use it and whether local managers can demonstrate its application.
Walk through one process with the French team: onboarding an intermediary, approving hospitality or escalating an unusual payment. Ask the people doing the work to locate the relevant rule and explain the next step. Compare their answers with the procedure and with a completed file.
For a group organised across several countries, create a concise deployment matrix. Useful columns include entity, responsible person, applicable policy, working language, evidence location and open issue. Treat “available on the intranet” as a location, then separately check whether the intended users know how to find and use the material.
Where local procedures differ, document the reason and the approval. This gives management a clearer view of implementation than a single group-wide completion percentage.
Run a focused evidence and interview exercise
As an internal preparation exercise, choose a small sample across higher-risk activities. Include a file that was approved, one that required escalation and, where available, one that was refused or suspended. Record why the sample was chosen; do not present it as assurance over the entire programme.
- Reconstruct the decision. Can someone follow the sequence without relying on the original employee’s memory?
- Compare the accounts. Do procurement, finance and compliance describe the same approval and escalation routes?
- Resolve inconsistencies. Is a difference caused by an outdated document, a process failure or an incomplete record?
- Track the correction. Name the person responsible, set a realistic deadline and specify what will demonstrate completion.
Use interview preparation to check understanding and identify uncertainty. Encourage colleagues to distinguish what they know, what the records show and what they need to verify. Practising a polished answer is less useful than resolving an unexplained exception.
Organise the response when an AFA notification arrives
The AFA says the initial questionnaire generally carries a response period of one month. Read the notification carefully and organise work around the requests and timetable actually received. AFA audit procedure.
Appoint a response coordinator and agree how compliance, legal, finance, HR and the relevant business teams will contribute. Use a controlled request register linking each question to its owner, response, supporting file, review status and submission date. The AFA’s questionnaire asks for responses and supporting documents to be linked to the relevant question number. Questionnaire instructions.
Separate workstreams for information collection, factual review and corrective action. Apply appropriate access arrangements to sensitive files, and involve legal advisers in questions about protected material. Keep submitted versions identifiable so that later explanations refer to the same record.
The charter provides for observations on the provisional report and an action plan. Prepare a factual response supported by documents, with named owners and a timetable for proposed improvements. Read the audit charter.
Frequently asked questions
Can an international group rely on its existing global compliance programme?
It can use that programme as a starting point. The preparation review should still establish the French legal scope and test how the framework operates in the relevant entities. A reference to FCPA or UK Bribery Act compliance does not itself establish compliance with Article 17.
Are the AFA’s recommendations mandatory?
No. The AFA explains that its recommendations do not create obligations for companies. Companies may use other methods if their implementation achieves compliance with the law. AFA guidance on legal status.
Can a company be sanctioned without a proven bribery offence?
Yes. Failures to meet Article 17 prevention requirements can lead to enforcement independently of a proven bribery offence. The Sanctions Committee may order remediation and impose fines up to €1 million for legal entities and €200,000 for individuals. Article 17, sections IV–V.
What should executives check first?
Confirm the entities in scope, identify the person coordinating the review and select a recent higher-risk decision to test. Use that exercise to prioritise missing evidence, unclear responsibilities and controls that need attention.
Where does your preparation need attention?
Discuss your group’s risk mapping, documentation and training priorities with ACTUO Conseil. Start with the gaps that matter to your operations in France.
Discuss your AFA audit preparation