In today’s uncertain and complex environment, Sanofi has built a robust risk management framework to create long-term value, drive continuous improvement and innovation, and safeguard our company's assets. This framework is compliant with regulations and aligned with sector best practices.
Risk Management Framework
Sanofi’s risk management framework ensures clear accountability and strong capabilities for managing risks across the entire organization. It supports informed decision-making aligned with risk exposure and enables effective information exchange with stakeholders.
The framework is structured around three lines of defense:
- First line - Operational management and business units, who own and manage risks day-to-day
- Second line - The Risk Management function, providing oversight, guidance, and framework
- Third line - Sanofi Internal Audit, providing independent assurance
Key governance bodies include the Sanofi Risk Committee (SRC), the Risk Management team and network, the Executive Committee, the Board of Directors and the Audit Committee.
Active and Emerging Risks
Sanofi employs a comprehensive approach to monitor and manage potential threats and opportunities through its risk profile and emerging risk radar. This system captures and evaluates all categories of risks based on their potential impact on the company.
Sanofi categorizes risks into two main types: active risks and emerging risks.
- Active risks are those that may affect the company within a 3-year timeframe. These risks require immediate attention and management to mitigate their potential impact.
- Emerging risks, on the other hand, encompass trends that could present threats or opportunities over a 7-year horizon and beyond. These risks are monitored and addressed proactively to prepare for potential future impacts.
Our Risk Management Approach
Sanofi applies a structured risk management process, including active risks and emerging risks identification, evaluation and prioritization, risks treatment and for a selection of emerging risks, development of scenarios to understand their potential impact on the company. This methodology allows us to capture all categories of opportunities and threats closely tied to our strategy and inherent to our business.
Risk Identification
Sanofi uses outside-in, top-down and bottom-up approaches to identify both active and emerging risks, drawing on insights from senior leaders, the risk management network, and reliable external sources.
Risks Evaluation and Prioritization
Risks and emerging risks are assessed based on severity and likelihood. For active risks this evaluation is complemented by assessing the level of control. For emerging risks, the evaluation includes assessing the velocity.
Active risks are then classified into four categories: vigilance, surveillance, watch list, and control adapted. Emerging risks are prioritized by the Executive Committee based on Risk Committee recommendations.
Risk Treatment and Monitoring
Risk leaders design and monitor mitigation plans. The Risk Committee reviews the mitigation plans and recommends priorities to the Executive Committee which approves the overall approach. Progress of mitigation for risks under vigilance is overseen by both committees and communicated to the Audit Committee of the Board of Directors.
Emerging Risks Deep-dive
Scenarios are developed for prioritized emerging risks, identifying signals that they might become active and proposing early response actions.
Examples
To illustrate these concepts, here are concrete examples of how Sanofi manages both active and emerging risks:
-
An example of active risk is related to Data Ethics, Privacy & Sovereignty. This risk concerns Sanofi's ability to manage personal data responsibly in an increasingly complex and geopolitically fragmented regulatory landscape. Privacy regulations are becoming instruments of national sovereignty, while the deployment of GenAI and agentic AI introduces additional exposure. Failure to address these challenges may erode stakeholder trust, trigger regulatory sanctions, and undermine Sanofi's ability to operate and innovate at scale.
-
An example of emerging risk is related to Quantum Disruption in Drug Discovery. This emerging risk concerns the transformative potential of quantum computing technology, which leverages quantum mechanics to perform calculations far beyond classical computers' capabilities. In drug discovery, quantum computing enables ultra-fast molecular modeling, target identification, and compound optimization that could significantly accelerate R&D timelines and reshape competitive dynamics across the pharmaceutical industry. It is therefore important that Sanofi anticipates and prepares for this technological shift to avoid losing competitive advantage to more agile or technologically advanced players.