Carrefour - 2017 Registration Document

2 CORPORATE SOCIAL RESPONSIBILITY Carrefour’s duty of care plan CARREFOUR | 2017 REGISTRATION DOCUMENT 89 Identification and description of risks and risk situations Identifying risks therefore combines several approaches, which are summarised in the diagram below: Internal databases built for the approach Data that can be exploited for the approach PROCESS MAPPING THIRD-PARTY DATABASE RISK DATABASE Risks arising from Carrefour’s own operations Risks arising from third parties acting on Carrefour’s behalf or under the Carrefour banner Sensitive processes Sector exposures RISKS, RISK SITUATIONS AND SCENARIOS RELATED TO THE DUTY OF CARE BUSINESS PROCESS APPROACH BUSINESS SECTOR APPROACH INTERNAL DATA SECTOR CLASSIFICATION GEOGRAPHICAL APPROACH EXTERNAL INDICATORS COUNTRY LIST Geographical exposures NGO action areas LIST OF KNOWN CASES Sensitive commodities PROCESS MAPPING EXTERNAL INDICATORS The business approach consists of cross-referencing the Carrefour process risk map (more than 400 processes mapped) with the compliance risk database to identify “sensitive processes”, and describing the risk situations encountered in these sensitive processes. The geographical approach consists of identifying country risks based on recognised external public indicators (risks relating to human rights or the environment). The sector approach (based on the “NAF” business sector classification used in France) consists of supplementing the operational and geographical approaches with an assessment of the risks relating to each business sector according to the compliance risk database based on several information sources: a review of incidents already encountered by the Group or ● companies operating in comparable or related sectors, through an in-depth analysis of “public cases”; internal and external consultations and appraisals; ● sector and thematic reviews. ● This combination of approaches is supplemented by cross-referencing with other information sources, including: a regularly updated list of known human rights or environmental ● violations by companies operating in the retail industry or comparable or related sectors; consultations with NGOs actively involved in environmental and ● human rights issues, and a documented analysis of known actions taken by NGOs that campaign for human rights and the environment in order to identify and cross-reference issues of interest and the main countries concerned. Each risk situation is therefore assessed for its inherent risk based on the probability of occurrence and the severity of its potential impacts. The assessment takes into account risk factors according to their impact on probability and/or severity. For example, the existence of previous known cases similar to the situation under review is an aggravating factor with an impact on the probability of occurrence. Geography can also be an aggravating factor for some compliance risks. Severity is assessed on the basis of five types of potential impact on the Group or its stakeholders: business, financial, legal, human/social and image. Rating scales and assessment indicators are assigned to each of the two assessment criteria. After assessment, the risk situations and related risks are then ranked in order of importance using a risk classification and ranking grid (minor risks, significant risks or major risks, according to the combination of probability and severity).