Internal Control in the Context of Whistleblowing

As part of a proactive approach to preventing, detecting, and addressing illegal situations that may arise, Article 17 of the Sapin II law stipulates that all organizations, whether public or private, must implement an assessment and control system for their measures. To ensure that internal control remains relevant in the current pandemic, sectoral, and economic contexts, the French Anti-Corruption Agency (AFA) has updated its 2017 recommendations, including those related to whistleblowing.

Internal Control: What Is It? 

Until early 2021, the AFA's recommendations regarding transparency, anti-corruption efforts, and the modernization of economic life for businesses were based on eight pillars. Given the current health and social context and the many changes in the economic landscape, these recommendations have been revised and now rely on three core foundations. These must be adapted according to the organization's needs, expectations, and challenges to ensure it continues to create value:

• A risk mapping system;
• Risk management measures;
• A strong commitment from company leadership.

Risk Mapping 

For effective risk management, the AFA recommends that businesses establish a detailed, comprehensive risk map based on a thorough and clear understanding of their industry, employees, positions, and the risks that may arise from these elements. This mapping serves as a critical tool for preventing such risks.

Risk Management 

Actions must be implemented for risk prevention and detection, monitoring and evaluating the anti-corruption framework, and addressing any detected risks.

Commitment from Company Leadership 

The company’s leadership—those responsible for its operations—must now ensure:

• The implementation of a strict anti-corruption and anti-fraud policy within the organization;
• Zero tolerance for individuals who do not adhere to the policy;
• That this policy is the subject of a prevention and communication campaign aimed at all company employees;
• That it applies equally to company leadership, ensuring equality across all organizational levels;
• That all necessary resources are deployed to ensure the policy's effective implementation;
• Clear and relevant communication, adapted to the company's structure, covering essential topics such as the code of conduct, ethics, training, and, of course, the internal whistleblowing system.

What About Internal Control for Whistleblowing?

Whistleblowing is also among the topics revised by the AFA. According to the agency, the procedure related to the internal whistleblowing system—meant for monitoring the processing of alerts (dedicated committees, investigation reports, and data retention)—must be clearly defined and formalized.

Its new recommendations cover the following aspects:

• The scope of the internal whistleblowing system within the controlled entity;
• The mandatory presentation of supporting documents (guides, notes, materials) explaining the collection and processing of alerts (especially investigation procedures and follow-ups);
• Making the whistleblowing system available in multiple languages if necessary, with a list of available languages provided;
• The operational mode of the whistleblowing management committee;
• The different channels for reporting alerts (hierarchical chain, email or physical address, dedicated IT system, etc.), specifying their structure, interconnections, and technical features;
• The classification of alerts by category (HR alerts, environmental alerts, ethical alerts, etc.);
• The anonymity of alerts;
• A specific procedure for internal investigations, including a process to determine the veracity of reported facts;
• A system that informs the whistleblower of the successful receipt of their alert and whether it has been deemed admissible;
• Training for personnel involved in implementing the system;
• The timeframe for processing alerts.

BeSignal Supports You in Implementing AFA’s Recommendations 

For the successful implementation of AFA’s recommendations, an efficient and effective internal whistleblowing system, and internal control that meets regulatory requirements, BeSignal is here to support your organization every step of the way.