Carrefour - 2017 Registration Document

4 MANAGEMENT’S DISCUSSION AND ANALYSIS AS OF DECEMBER 31, 2017 Risk management CARREFOUR | 2017 REGISTRATION DOCUMENT 201 in June 2017, establishing a formal anti-bribery and corruption ● policy and its presentation to the staff representative bodies. Bribery and corruption risks were mapped as part of the Group’s compliance risk mapping exercise. It is based on a review of all third parties with which the Group has a relationship and combines several approaches that look at the Group’s business and geographical operations from different angles. The Group’s stakeholders were involved in the process of reviewing the principal risks according to their areas of expertise. A structured approach and an ordered view of the risks were shared with the countries and relevant internal functions. To implement this policy, the countries used communications tools illustrated with specific examples for the targeted audience, for example at purchasing level or store level. A training system has been set up and is aimed at managers and other employees who are most exposed to the risk of bribery and corruption. The Group has established rules applicable to all employees on accepting gifts and invitations. All employees involved in a purchasing, negotiation or accreditation process (principal, buyer, decision-maker) are required to sign a statement of independence each year. Any potential conflicts of interest are addressed in accordance with the Group’s Ethics Principles; drawing up a formal duty of care plan. The approach is based on ● Carrefour’s Ethics Principles, a Code of Conduct setting the framework for the day-to-day behaviour and actions of its employees. The aim is to instil these same principles throughout the global value chain through the Supplier Charter and Ethical Standards Charter, which are an integral part of all purchase contracts for goods and services in all of Carrefour’s countries of operation. It is rolled down to the Group’s various business activities through many other initiatives, including partnerships, dialogue with stakeholders, CSR strategy and social dialogue. It takes form through the engagement of the women and men who work for the Carrefour group. The relevance and completeness of the duty of care plan will be assessed in working meetings with stakeholders, particularly those with expertise in the matters addressed by the plan: WWF ® France, the International Federation for Human Rights (Fédération internationale des ligues des droits de l’homme – FIDH) and UNI Global Union. As required by the law, the Group will report annually on the implementation of this duty of care plan. The first report will cover 2018 and will be published in 2019. Within the Group, the adoption and implementation of risk management principles is delegated to the Group Functional Departments and the Country Executive management teams, which are responsible for identifying, analysing and addressing the main risks they face. The Group’s Functional Departments are responsible for identifying and documenting the main risk management rules applicable to their function. They support the countries in implementing their own rules by organising and running functional networks. The Country Executive management teams: perform regulatory monitoring and recognise impacts; ● establish procedures and suitable measures for preventing and ● protecting against risks occurring and limiting impacts; manage incidents; ● notify the Group’s Executive Management of any event that is ● likely to have an impact on the Group’s image or financial performance. The Group Risks & Compliance Department leads the risk management system and provides methodological support to the Operational and Functional departments. It does so by deploying an oversight, assessment and mapping tool for major risks and developing an operational risk map. The risk assessment tool is completed each year by the Country Executive Management teams on the basis of identified risk factors. These assessments are reviewed during interviews with the Group Risks & compliance department. The Group Risks & Compliance Department also worked on country-by-country mapping of health risks, natural risks, criminal and terrorist risks, and legal risks, while conducting studies on emerging risks and supporting certain Operational Departments. It also supports the Purchasing Departments in expanding their knowledge and assessment of supplier risk. In operational terms, the Group Risks & Compliance Department coordinates and leads a network of Security/Risk Prevention Directors present in all Group countries. Since 2011, Carrefour has regularly communicated a Risk prevention Charter which defines the scope of action, the role and responsibilities of the country-level Security/Risk Prevention functions, and the ethical rules they must follow. In each country where the Group operates, a Security/Risk Prevention Department is responsible for the security of the Company’s property, equipment and intangible assets and ensures the safety of the people on its sites. It is tasked with implementing the human, organisational and technical resources necessary to manage both accidental and intentional risks (natural disasters, malicious acts, theft, etc.). The safety and security of people and property is one of the essential elements of the risk management system, ensuring: protection suitable for the Group’s customers, employees, ● service providers and sites; regulatory compliance of sites in all countries where the Group ● operates; protection and enhancement of the Group’s image and ● reputation. The prevention policy relies on risk mapping, loss analysis and the identification of emerging risks as part of an ongoing oversight process and specific studies. The Group Risks & Compliance Department prepares a consolidated annual report on the Security/Risk Prevention function at Group level, with benchmarks between management and performance indicators for the function in each country, in terms of loss, workforce, resources and action plans.