Where the company prepares consolidated accounts, the eight measures must apply to the company and all its subsidiaries and controlled companies, in France and abroad. The AFA expects the parent's risk map to take account of controlled entities' risks (they send their maps and action plans to the parent, which follows them), the internal alert system to be deployed across the whole controlled perimeter, and procedures and internal control to check the quality and effectiveness of subsidiaries' programmes (recommendations paragraphs 91, 123 and 261). The July 2026 sanctions decision faulted missing measures at subsidiary level.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.