01 05 09 02 06 10 03 07 11 04 08 12 13 14

P ◀ CONTENTS ▶
3.8.1 The risk identification process
is carried out in parallel
at the central level for the Group,
and locally:
• the Group Executive Committee regularly updates
its Group risk matrix and submits it to the Audit
Committee and the Board of Directors;
• the Chief Executive Officers of the main Group
subsidiaries identify the ten to fifteen main risks
and rank them by order of importance, describe
the controls in place in order to manage them,
and evaluate their effectiveness; and
• these local evaluations are aggregated at Group
level and submitted annually to the Audit
Committee.
The main risk factors to which the Group is exposed
are described on pages 166 et seq. of this Registration
Document.
3.8.2 Assessment of internal control
procedures
The French “Financial Security Act” (Loi sur la
Sécurité Financière) and the Sarbanes-Oxley Act
in the United States have allowed Sodexo to make
considerable progress in the area of internal control.
Sodexo decided to seek a listing in the United States
primarily in order to facilitate the participation of
U.S. employees in employee share ownership plans.
However, the increasingly international nature of
the financial markets has removed the need for
this U.S. listing. In addition, the high cost of this
listing and low trading volumes justified Sodexo’s
voluntary delisting of its shares from the New York
Stock Exchange and related deregistration from U.S.
stock market regulations in 2007. However, Sodexo is
committed to upholding and improving these same
internal control procedures insofar as possible.
The internal control procedures are part of an ongoing
process of identifying, evaluating and managing the
Group’s risk exposures. This initiative covers the five
components of the COSO (Committee of Sponsoring
Organizations) (see glossary): control environment
(integrity, ethics, competencies, etc.), evaluation of
risks (identification, analysis and management of
risks), control activities (methods and procedures),
information and communication (collection and
sharing of information), and monitoring (followup
and eventual updating of processes). Strongly
Corporate Governance 10
Chairman’s Report on the Operating Procedures of the Board of Directors
and on Internal Control and Risk Management Procedures
endorsed by the Chief Executive Officer and Group
Chief Financial Officer, the CLEAR initiative was
approved by the Board of Directors and the Audit
Committee, and also received the backing of the
Group’s Executive Committee.
The risk management and internal control approach
applied within the Group consists in:
• the identification and assessment of risks;
• the description of the control environment, both
at Group and subsidiary levels;
• documentation and self-assessment of these
control points both in subsidiaries and at Group
level; and
• independent testing of the effectiveness of these
control points, by independent persons.
A very large number of Group subsidiaries
representing more than 95% of Sodexo’s revenues
prepare a detailed report (Company Level Control
Report) on their control environment, described in
accordance with the five COSO components, and
including an evaluation of the subsidiary’s principal
risks, a description of risk management measures,
and assessment of their effectiveness.
The most significant Group subsidiaries together
representing more than 90% of Group revenues, go
beyond this initial phase, documenting and then also
self-assessing their transactional controls.
Sodexo has developed a guide to risks and control.
Under the program, Group activities have been
segmented into twelve significant processes,
namely: Revenues and Receivables, Purchases and
Payables, Human Resources, Treasury, Inventories,
Property, Plant and Equipment and Intangible
Assets, Legal and Regulatory, Information Systems
and Technologies, Finance, Motivation Solutions
Operations, Headquarters Entities, and Health and
Safety. For each of these processes, the guide lists
several control proposals for each of the major risks.
Each subsidiary is then responsible for implementing
and evaluating the effectiveness of those controls
that it considers best able to reduce its risks, in
coordination with its Business Unit and the Group.
An executive summary of the status of internal
controls and the progress achieved is submitted to
the Audit Committee at the end of the fiscal year.
In Fiscal 2011, Sodexo continued to implement
the progress initiative launched in prior years.
Specific areas for improvement were selected
Sodexo Registration Document Fiscal 2011
243
01
02
03
04
05
06
07
08
09
10
11
12
13
14