France Risk & Compliance Statistics

Key findings

France-based organizations closely track European program maturity

To help determine the state of programs in 2025, NAVEX asked respondents to self-report their risk and compliance (R&C) program maturity based on the Framework for Ethics & Compliance Program Excellence criteria from the Ethics and Compliance Initiative (ECI). This five-point scale begins at the least mature, “Underdeveloped,” and advances in maturity through the stages of “Defining,” “Adapting,” “Managing” and, finally, “Optimizing.” It is worthy of note that there is no “end” to the spectrum – even the most mature programs have room to refine their approach. 

Sixty-two percent of respondents representing organizations based in France said their R&C program was either Managing or Optimizing – the two most mature designations on the ECI scale. Fourteen percent said it was Defining or Underdeveloped – the two least-mature designations. For Europe as a whole, 60% were said to be in the more mature designations, with 16% in the less mature designations. Globally, 57% of organizations were said to be at a top-two maturity level, and 18% in the lower two.

‘Privacy/cybersecurity breach’ tops compliance issues for French organizations

Consistent with previous polling, data privacy/cybersecurity breaches remain the top compliance issue respondents said their organizations experienced in the past three years. Still, nuances remain that may help readers better understand how they compare to regional peers.

Respondents from France-based organizations were about as likely (30%) as those in Europe as a whole (27%), but less likely than globally (35%), to say their organization had not experienced any compliance issues in the past three years. French organizations were also said to be less likely (12%) than those in Europe as a whole (18%) to have experienced substantiated employee litigation against the organization, closer to the global response rate of 14%.

Like others, most French compliance investigation programs are centralized

Globally, most respondents (67%) said their organizations use a centralized approach in their day-to-day compliance investigations program. This was largely consistent with France-based organizations, where 69% of respondents said their organization uses a centralized investigations program. Generally, response rates for this question for France, Europe and globally were very similar.

Boards of French organizations show slightly higher engagement with compliance programs

It stands to reason that organizations where boards of directors are engaged in Compliance are more effective and resilient in R&C.

For France-based organizations, 39% of respondents knowledgeable about ethics and compliance said their board of directors was highly engaged with their compliance program. This compares to 32% in Europe, and 33% globally.

Thirty-two percent of respondents from French organizations said their board has oversight over risk identification and management – roughly level with global figures and Europe as a whole.

Consistent with trends, Compliance is most likely to be ‘somewhat involved’ in use of AI for French organizations

As artificial intelligence plays an evolving role across different organizations, the role of Compliance in its implementation is also evolving.  

For respondents at France-based organizations, Compliance was most likely to be ‘somewhat involved’ (39%) in decisions regarding the use of AI. This was consistent with rates in Europe and close to rates globally. Generally, respondents in our different cohorts responded similarly about compliance’s level of involvement.

Only 46% of French organizations are said to have a hotline

NAVEX survey data continue to show a concerningly low rate of respondents globally indicating that their organization has an internal whistleblower hotline. This is despite the fact that a mechanism for individuals to report misconduct anonymously and/or without fear of retaliation is a core part of any compliance program.  

For organizations based in France, 46% of respondents knowledgeable about ethics and compliance said the organization had a hotline or whistleblower internal reporting channel. This was consistent with 45% percent in Europe, but below 53% globally. 

The lack of indication of a process to detect retaliation is also notable. For French organizations, 26% were said to have a process to detect retaliation. For Europe, this was 28%, and globally, 29%. While French organizations are generally consistent with European and Global responses, this may still be cause for readers to consider if their own programs are delivering on their goals.