Internal Audit
Procurement Governance 2026

Compliance Stress-Test: Legal Exposure, CSRD and P2P Leakage.

Instantly measure the legal (AFA / URSSAF) and ESG (Scope 3) coverage ratio of your "Class C" supplier panel. The model also quantifies your EBITDA destruction linked to the Procure-to-Pay process.

🔒
Guaranteed Anonymity No financial data is stored. Calculation runs locally.
📊
SBF 120 Benchmark Calibrated on tier-1 audit matrices.
⏱️
Real Time Summary report generated across 7 data points.
Risk-transfer methodology validated by industry leaders:
SPIE L'ORÉAL Aptar P&G
Why this stress-test

Why audit your "Class C" supplier panel?

Class C suppliers, those representing low spend volume but a high number of accounts, carry a disproportionate amount of risk. They typically fall outside standard onboarding checks, AFA and URSSAF compliance controls, and the extra-financial reporting requirements introduced by the CSRD.

  • Legal exposure. Share of the panel not covered by an anti-corruption compliance check (Sapin II law) or URSSAF due diligence.
  • ESG / Scope 3 exposure. Share of suppliers with no usable emissions data for CSRD reporting.
  • EBITDA destruction. Administrative processing cost of non-strategic orders, often underestimated by procurement teams.
AFA & URSSAF Compliance

Supplier compliance: what the Sapin II law and URSSAF actually require

The Sapin II law requires companies with more than 500 employees (and 100 million euros in revenue) to map their risks and assess the integrity of third parties, including low-volume suppliers. At the same time, URSSAF due diligence, the obligation to verify the social compliance of subcontractors and service providers, holds the principal jointly liable in the event of undeclared work at a supplier.

In most organizations, these checks are applied to strategic suppliers and neglected across the tail spend, precisely because it is fragmented across hundreds, even thousands, of low-stakes supplier accounts. Legal risk, however, does not track spend volume: a single uncontrolled supplier is enough to expose the company.

CSRD & Scope 3

CSRD and Scope 3: the blind spot of tail spend purchasing

The CSRD directive now requires large companies to report in detail on their indirect emissions, with Scope 3 covering emissions generated across the supply chain. This obligation is not limited to strategic suppliers: the entire panel must eventually be able to provide usable data.

Class C suppliers pose a specific problem: poorly structured and rarely asked about their environmental practices, they are often the least documented segment of the panel, even though they can weigh significantly on the total number of suppliers that need to be covered for complete reporting.

P2P Leakage & EBITDA

P2P leakage: a hidden cost in the Procure-to-Pay process

Every order, even a small one, triggers a full process: purchase request, approval, purchase order creation, receiving, invoice matching, payment. For a strategic, high-volume supplier, this processing cost is spread across many transactions. For a Class C supplier used once or twice a year, the administrative processing cost can exceed the value of the order itself.

This leakage remains largely invisible in standard procurement dashboards, which focus on spend volume rather than unit processing cost. Yet it represents a real, measurable EBITDA loss, one that this stress-test helps estimate.

Frequently Asked Questions

What you need to know about supplier compliance and P2P leakage

What is a "Class C" supplier in procurement? +

A Class C supplier is one representing low annual spend volume, typically part of the tail spend. It contrasts with Class A and B suppliers, strategic or high-volume accounts that concentrate most of the spend.

What is P2P (Procure-to-Pay) leakage? +

P2P leakage refers to the administrative processing cost of an order (approval, purchase order, receiving, invoicing) when it exceeds the actual value added by the purchase, particularly for low-value, high-frequency orders spread across many suppliers.

Does the CSRD apply to tail spend suppliers? +

Yes, since Scope 3 reporting covers the entire value chain. Companies subject to the CSRD must progressively collect data across their full supplier panel, including low-volume accounts.

What is the difference between AFA compliance and URSSAF due diligence? +

AFA compliance (Sapin II law) concerns the prevention of corruption and influence peddling in third-party relationships. URSSAF due diligence concerns the social compliance of subcontractors and holds the principal jointly liable in the event of undeclared work. The two obligations are distinct but cover the same scope: the entire supplier panel, not just strategic accounts.