Sapin 2 software – AFA control questionnaire

The Sapin II Act provides that the French Anti-Corruption Agency (AFA)“shall draw up recommendations to help legal entities under public and private law toto prevent and detect corruption, influence peddling, misappropriation of public funds, illegal interest taking and favoritism.

These recommendations are intended for all legal entities under private or public law, regardless of their size, corporate form, sector of activity, turnover or number of employees.

Although the AFA’s recommendations are published in the Official Journal, they are not binding and do not create any legal obligation for those to whom they are addressed. Other methodologies may be used provided that their implementation leads to an equivalent result in terms of substance.

The French Anti-Corruption Agency is not an independent administrative authority like the AMF or the ACPR for example. It is a service with national competence placed at the Ministry of Justice and the Ministry of Action and Public Accounts. For example, it has the same status as TRACFIN.

The AFA is placed under the authority of the Ministry of Justice and the Ministry of Public Action and Accounts.

The National Financial Prosecutor’s Office (PNF) is a judicial authority unlike the AFA which is anadministrative authority .

Created by the Sapin II law of December 9, 2016, the AFA’s mission is to help those who are confronted with it to prevent and detect acts of corruption, influence peddling, misappropriation of public funds and favoritism. The AFA’s mission of monitoring companies and public actors is part of this objective of prevention of corruption.

The National Financial Prosecutor’s Office (PNF), created by the law of December 6, 2013, deals with specific criminal investigations in the field of economic and financial crime. It thus contributes to the repression of corruption.

Although they have very different missions, these two authorities nevertheless maintain regular relations. The most significant example is the treatment of judicial public interest agreements (see dedicated question, below).

A provision of the criminal code allows the public prosecutor to enter into an agreement with a legal person accused or indicted for corruption, including several obligations, the execution of which extinguishes the public action. This agreement may provide for the implementation of a compliance program under the supervision of the AFA, which shall report to the public prosecutor, at his request and at least annually, on the implementation of the program. The AFA will also have to provide a report at the end of the execution period of the measure.

The company subject to an AFA inspection is informed by mail of the launch of the inspection and of the AFA agents in charge of it. The controls take place in two successive phases: a documentary control during which the company submits the documentation requested by the AFA, followed by an on-site control which consists of a series of interviews on the premises or remotely. At the end of the inspection, a report is drawn up containing the AFA’s observations, which may lead to a finding of non-compliance if the requirements relating to the existence, relevance and effectiveness of the system are not met. After receiving this report, the company has two months to provide comments. On this basis, the AFA draws up its final report. Depending on the shortcomings noted in this report, the AFA Director chooses to issue a warning or to refer the matter to the Sanction Commission.

The AFA distinguishes several types of controls. The “global” controls cover the eight measures and procedures of the Sapin II law, while the “thematic” controls cover a selection of measures such as the mapping of corruption risks, procedures for evaluating third parties, and, systematically, the involvement of the management body and the organization of the compliance function.

The compliance obligation applies to all subsidiaries of a group, whether they are located in France or abroad. AFA’s requests may therefore concern all of these subsidiaries. The answers should therefore be broken down by subsidiary.

In practice, it is not uncommon for AFA audits to target only a defined perimeter of subsidiaries, which makes it possible to limit the scope of documents to be provided. It is therefore important to determine, in conjunction with the agents in charge of the control, the perimeter covered by the control.

The AFA questionnaire includes nearly 180 questions of varying importance and density. The deadline for providing documents is relatively short, between 15 and 30 days. Companies often find it difficult to obtain the necessary documentation from their subsidiaries within such a tight timeframe.

It is therefore important for a company to prepare for the possibility of an audit by preparing the expected answers and centralizing the documents. This is all the more important when the issues are cross-cutting and concern different departments, branches or subsidiaries of a company.

The duration of AFA audits varies according to several factors, in particular the type of audit, whether global or thematic, the complexity of the company’s activities and the number of subsidiaries covered by the audit. The controls are sometimes spread out over a year.

After receiving the notice of inspection, the company has 15 days to provide the documents requested by the AFA. A first phase of control “on documents” then a second phase of control “on the spot” is opened. At the end of these two phases, AFA establishes a provisional report. The company then has two months to submit its comments. A final report is then sent to the company after which a warning may be issued by the AFA Director. The latter may also decide to refer the matter to the Sanction Commission when multiple breaches are found.

It should be noted that an AFA inspection may give rise to a “follow-up” inspection one or more years later to verify the implementation of the recommendations contained in the final report.