Universal Registration Document 2022

2.2.4 Risk management framework

2.2 Internal Control and Risk Management Procedures

2.2.4 Risk management framework

The Internal Audit Department of Publicis Groupe works in accordance with the international professional standards issued by the IIA (global lnstitute of Internal Auditors) and first obtained the certification of its activities from the IFACI (French Institute for Audit and Internal Control) in March 2017. This certification confirms the ability of the Publicis Groupe Internal Audit Department to fully carry out its duties. It was renewed in March 2020 and confirmed in March 2021 and March 2022 as a result of annual follow-ups.

2.2.3.2 Internal financial control framework

Publicis Groupe has set up a program called Financial Monitoring Controls (FMC), which is based on a list of key controls for the main processes contributing to financial and non-financial reporting.

These controls are implemented in all Groupe entities. Their implementation is monitored at two levels:

  • a monthly self-assessment, submitted by all Groupe entities via a common tool, contributes to accountability and transparency on the effectiveness of controls;
  • teams dedicated to FMC reviews are established at the regional level. These teams are linked to the Finance Department of each region and functionally to the Groupe’s Internal Audit, Risk Management and Internal Control Department, which oversees them, coordinates their work, and compiles their results. These teams follow a systematic review plan covering about 70% of the Groupe’s consolidated revenue each year.

Furthermore, a review of the key Corporate controls over financial reporting (Consolidation, Treasury, Tax, Legal, etc.) is conducted on an annual basis by the Internal Audit Department.

2.2.3.3 Monitoring by the Legal and Compliance departments

The Groupe’s Legal Department regularly monitors litigation-related risks within the Groupe. A summary of any significant legal disputes, as well as an estimate of their potential impacts, are presented to the Groupe’s senior management every quarter. The main legal disputes and current or finalized internal investigations, where relevant, are also discussed at each Audit Committee meeting.

The Compliance Department is managed by the Groupe’s Chief Compliance Officer, who reports to the Secretary General. Its objectives are to promote an ethical culture within the Groupe and to design, deploy and monitor the implementation of compliance programs in all Groupe entities.

This Department is supported by a network of compliance members operating at the local level. Under its supervision, they are responsible for coordinating and ensuring the effective deployment of compliance programs within their scope (see Section 4.2.10 of this document).

2.2.4 Risk management framework

In coordination with senior management, the business management teams of the countries/regions/business lines as well as the shared service centers are heavily involved in monitoring risks which the Groupe faces. They continually analyze the Groupe’s exposure to the loss of significant contracts, to risks of conflicts of interest and to changes in contractual clauses.

The risks relating to accounting information, external growth strategy, management of the liquidity position, foreign currencies, changes in the Groupe’s debt or tax position are monitored by the Finance Department, in cooperation with the senior management.

The risks associated with accounting and financial information are also monitored via the FMC program, managed by the Internal Audit, Risk Management and Internal Control Department.

The formalised monitoring of the Groupe’s risks began in 2008 through a risk mapping. The main risks that may have an impact on the Groupe’s accounting and financial information, operations or image are recorded. The impact and probability of occurrence are estimated for each risk identified; a level of risk is determined, which takes into account the various related control systems.

Thus, pursuant to article L. 225-102-1 of the French Commercial Code, it is stated that with regard to the Groupe’s activities, the financial risks associated with the impact of climate change have a non significant impact. However, the Groupe is mindful of measuring the environmental risks and finding solutions to reduce them (See Chapter 4 of the Universal Registration Document on CSR).

The risk map is updated on a regular basis to allow a dynamic enhancement of the risk management framework. Particularly for 2022, the Groupe’s risk map was updated and presented to the Strategy and Risk Committee meeting in March 2022. The “Risk Management” department has also carried out a quantified risk mapping on cybersecurity risks as well as an update of the corruption risk map and contributed to the work performed within the Groupe to comply with the Sapin 2 law.

These maps helped define the internal audit plan for 2023 in addition to other elements.