Country risk is a criterion often included in evaluations or due diligences such as those required by Article 17 of the Sapin II law. Here, we take a look at what you need to know about this type of indicator, and how best to incorporate it into your valuations.

A polymorphous concept

"In a context of globalization of trade and capital movements, multinational companies are increasing the risks inherent in the countries in which they are present or wish to invest. They are therefore obliged to take into account the concept of country risk in order to guide their investment and development strategies"(1).

For some, the notion formally appeared in a 1967 text by Frederick Dahl, while for others, the term predates and is closely linked to the Suez Canal crisis and its attendant nationalizations. The term "country risk" emerged in the United States in the 1960s, but many academic works had been written on the subject long before. The contours of the concept have evolved over time, without a single definition ever really taking hold. In the early days, it was closely related to political risk, then evolved over time towards the risk of sovereignty and the solvency of states, particularly with the emergence of rating agencies.

Today, it continues to extend to many other areas. Bernard Marois defines it as "the risk of a loss materializing, resulting from the economic and political context of a foreign state, in which a company carries out part of its activities (2)". Its overlap with the notion of risk makes it an appropriate candidate for risk managers and compliance officers when companies carry out risk assessments. Its relevance is self-evident, making it an essential part of any compliance system.

Relevant to the Sapin II approach

As far as the Sapin II law is concerned, the notion of country risk was introduced as soon as the law was promulgated: for the largest companies, Article 17, II°3 of the Sapin II law imposes the obligation to draw up "a risk map in the form of regularly updated documentation designed to identify, analyze and prioritize the risks of exposure of the company to external solicitations for the purposes of corruption, based in particular on the business sectors and geographical areas in which the company operates". For other organizations, the French Anti-Corruption Agency (AFA) also recommends (4) understanding the risk of corruption induced by the geographical location of their activities. Country risk is mentioned in points 141, 217 and 225 of the AFA's 2023 recommendations for private sector companies.

A reading of these recommendations reveals at least two uses for country risk in a system. The first is to use it as one of the components of risk group typologies. These typologies would then imply specific vigilance and/or mitigation measures, adapted for implementation. The country of establishment is therefore primarily a factor in determining the nature and depth of the analysis and risk assessment to be carried out on third parties.

Another possible use is to integrate country risk as a criterion in the evaluation of third parties as a weak signal or proxy, signifying exposure to the risk of corruption. At this stage, it is important to bear in mind that country risk is an indirect risk criterion, unlike reputational issues, for example. As the AFA reminds us, "a third party's exposure to the risk of corruption due to the geographical zones in which it operates cannot in itself summarize its exposure to the risk of corruption. Other risk factors must be taken into account in an effective assessment of these third parties". Country risk is thus a set of risks that may potentially and indirectly influence the relationship with a third party, but are not directly linked to it. For example, a company based in a country where corruption is widespread is not necessarily going to be involved in corrupt practices, but the probability is still higher than for a similar company based in another jurisdiction. Hence the importance of cross-referencing this information with other elements, such as the existence of an anti-corruption charter or system, the type of payment method used or the presence of intermediaries...

Two questions to ask yourself

Whatever use is appropriate to your context - and risk mapping will help you identify it - two major questions need to be asked:

Which benchmark(s) are best suited to my company's context?
- Indeed, there are many different benchmarks, with varying methodologies, sources and objectives. None can be considered the absolute standard in this field. The AFA's practical guide to indices for measuring a geographical area's exposure to the risk of corruption can be a useful resource for making the most appropriate selection. The NGO Transparency's Corruption Perceptions Index is often cited, but it is far from being the only resource and option for a relevant approach to corruption-related country risk. The AFA guide lists 18 such indices, and does not claim to be exhaustive.
On which dimensions should it be applied?
- While applying the benchmark(s) to the location of third parties in accordance with the recommendations seems relevant, applying them to other variables of third parties or their ecosystem, such as the location of their shareholders, the place where services are provided or their bank domiciliation, may also make sense in certain contexts. In such cases, you will need to adapt your data collection and sourcing processes, as well as the weighting and rating of these values in the assessment that will synthesize the analysis and exposure to the measured risk. From this point of view, the use of multiple reference frameworks depending on the dimension may be an approach that makes sense. For example, the FATF framework, which focuses on anti-money laundering measures (corruption being one of the underlying issues), could be applied to the location of the shareholder(s), or even to the bank domiciliation, rather than to the location of third parties.

Country risk is therefore an essential factor to take into account when building/improving your compliance systems. Whether it's the Sapin II Act, the Duty of Vigilance Act or even other regulations, the richness and versatility of the country risk concept make it an important ingredient. Care must be taken, however, in choosing which benchmark(s)/index(es) to use. The other challenge concerns this information, and lies in how to integrate it into the third-party assessment process in a fluid and industrial manner.