Corruption Risk Mapping: Method and Requirements for Anti-Bribery Compliance
Corruption risk mapping is the process of systematically identifying, evaluating, and documenting the situations in which an organization or its employees could be exposed to bribery or corruption. It is not a one-time exercise but a living document that guides the design and prioritization of anti-bribery controls. French law Sapin 2 makes this mapping a mandatory element of the compliance programme that organizations above defined thresholds must implement. ISO 37001 (the international anti-bribery management system standard) likewise requires a bribery risk assessment as the foundation of the entire management system. The French Anti-Corruption Agency (AFA) has published methodological guidance specifying the structure and depth expected. An organization that produces a cursory or incomplete map risks a critical finding in the event of an AFA audit. Optivalue.ai guides compliance teams through a structured risk mapping workflow that meets the AFA's methodological requirements and integrates with the broader anti-bribery programme. This article explains the methodology, the required outputs, and the process steps that produce a legally defensible corruption risk map.
What does French law Sapin 2 require from a corruption risk map?
French law Sapin 2 requires organizations above defined thresholds to implement a bribery risk mapping as one of eight mandatory programme elements. The AFA's guidance specifies that the mapping must: identify the risk scenarios to which each business function is exposed; evaluate each scenario on the two dimensions of likelihood and potential impact, producing a risk level; take into account both the inherent risk (before controls) and the residual risk (after controls); and be validated by senior management. The mapping must cover both active corruption (the organization paying or offering something of value) and passive corruption (employees receiving something of value), as well as influence peddling. The output must be a documented, dated, and version-controlled file that the AFA can review. For a broader overview of the Sapin 2 programme requirements, see the anti-bribery compliance programme guide.
What is the methodology for building a corruption risk map?
A corruption risk mapping process typically follows four stages: scoping, scenario identification, risk evaluation, and control mapping. In the scoping stage, the compliance function defines which entities, geographies, business functions, and activities fall within the mapping. In the scenario identification stage, the team works with business unit representatives to list the concrete situations in which corruption could occur -- for example, awarding a contract to a supplier, interacting with a customs authority, or negotiating a commercial agreement. In the risk evaluation stage, each scenario is scored on likelihood (how probable is it that this situation could lead to a corrupt act) and potential impact (what would be the consequence if it did). In the control mapping stage, the existing controls are documented against each scenario and the residual risk level after controls is assessed. For guidance on the broader risk mapping methodology that supports this process, see the risk mapping methodology guide.
What is the difference between inherent risk and residual risk?
The distinction between inherent risk and residual risk is central to the corruption risk mapping methodology and is specifically referenced in AFA guidance. The inherent risk is the level of risk present before any controls are applied: it reflects the raw exposure created by the organization's business activities, geographies, counterparty types, and transaction flows. The residual risk is the level of risk that remains after existing controls are taken into account. The gap between the two figures for each scenario indicates the effectiveness of the control environment. Scenarios where residual risk remains above the organization's defined risk appetite require additional control measures to be designed and implemented. Scenarios where controls are strong and residual risk is low can be deprioritized in the control investment plan. Software supports this evaluation by providing a structured scoring framework and a visual risk heat map that makes the relative priority of scenarios immediately legible.
How should risk scenarios be identified and validated?
Identifying corruption risk scenarios requires direct engagement with the business functions that carry the exposure. A compliance team working in isolation will miss the granular process details where corruption opportunities arise. The standard approach is to conduct structured interviews or workshops with representatives of each business function, using a facilitated questionnaire that walks through the activities, counterparties, and pressure points specific to that function. The resulting scenario list is then reviewed by the compliance function, cross-referenced with the organization's anti-bribery incident history and sector benchmarks, and validated by senior management before the evaluation stage begins. The participation of business units in this process also builds awareness of corruption risk among the staff who face it in their daily work, which reinforces the training and code of conduct elements of the programme.
How does the risk map connect to anti-bribery controls and the GRC platform?
The corruption risk map is not a standalone document: it is the input that determines which controls are required, at what intensity, and for which business functions. A scenario assessed as high residual risk should prompt the design of additional controls -- enhanced due diligence for the counterparty category, additional approval steps in the affected process, or targeted training for the exposed function. Controls must be documented against the scenarios they address, so that the compliance function can demonstrate that the programme is proportionate to the risks identified. Integrating the risk map within a GRC platform ensures that the risk assessment, the control inventory, and the monitoring results are held in a single system and that changes in the risk environment are reflected across the compliance programme. For guidance on GRC platform selection, see the GRC software selection guide.
How often must the corruption risk map be updated?
The AFA's methodological guidance recommends that the corruption risk map be reviewed at least every two years and whenever a material change occurs in the organization's activities, structure, or operating environment -- for example, a new market entry, a merger or acquisition, a significant change in the regulatory context, or the emergence of a new corruption risk scenario in the organization's sector. Updates must be version-controlled, and the updated map must be re-validated at the senior management level. Optivalue.ai provides version history and review cycle management for the risk mapping file, so the compliance function can demonstrate at audit that the map is current and that prior versions are preserved.
Ready to structure your corruption risk mapping process? Optivalue.ai provides the methodology, templates, and audit trail your programme requires. Request a demonstration.
Frequently Asked Questions
What is corruption risk mapping and why is it legally required? Corruption risk mapping is the process of identifying the situations in which the organization or its employees could be exposed to bribery or corruption, evaluating the likelihood and potential impact of each situation, and documenting the controls applied to address them. French law Sapin 2 makes this mapping mandatory for organizations above defined thresholds; ISO 37001 requires it as the foundation of any anti-bribery management system.
What methodology does Sapin 2 prescribe for corruption risk mapping? Sapin 2 requires the risk mapping to identify risk scenarios by business process, evaluate each scenario on likelihood and potential impact, and prioritize them to guide the allocation of anti-bribery controls. The French Anti-Corruption Agency (AFA) has published guidance specifying that the mapping must cover internal and external risks, be updated regularly, involve business units in its construction, and be validated at the senior management level.
What is the difference between an inherent risk and a residual risk in a corruption risk map? The inherent risk is the level of risk present before any controls are applied: it reflects the raw exposure created by the organization's activities and context. The residual risk is the level of risk that remains after the existing controls are taken into account. The gap between inherent and residual risk for each scenario indicates whether the controls are sufficient. Scenarios where residual risk remains above the organization's risk appetite require additional control measures.
How often must the corruption risk map be updated? The French Anti-Corruption Agency (AFA) recommends that the corruption risk map be reviewed at least every two years and whenever a material change occurs in the organization's activities, structure, or operating environment -- for example, a new market entry, an acquisition, or a change in the regulatory context. More frequent updates may be required for high-risk scenarios or where the control environment has changed significantly.
Back to topOn the same topic