Darya Khendrik, Author at Clever Cloud From Code to Product Wed, 26 Aug 2026 14:03:23 +0000 en-GB hourly 1 https://cdn.clever-cloud.com/uploads/2023/03/cropped-cropped-favicon-32x32.png Darya Khendrik, Author at Clever Cloud 32 32 The audit as a weapon: compliance, another battlefield of economic warfare https://www.clever.cloud/blog/company/2026/08/26/compliance-economic-warfare-audit/ Wed, 26 Aug 2026 14:03:22 +0000 https://www.clever.cloud/?p=25356 2026.08.26 Clever Cloud Bannière Blog Audit Comme Arme EN

The story is that of a French company engaged in a commercial dispute with a local competitor, abroad. The authorities of the country decide to launch an audit and the company, anxious to be beyond reproach, agrees to hand over financial data as well as information on its manufacturing processes.

The result: the company is hit with a surcharge all the same, then loses the majority of its customers to the competitor that had reported it. In the meantime, it has handed over valuable economic information which, for its part, can never be taken back.

This case led me to consider a dimension of compliance that we do not discuss enough for my liking. We generally regard it as a way of reducing risk, protecting the company and establishing trust.

But what happens when the tools of compliance (the audit, the inspection, the certification) stop being safeguards and become weapons of economic warfare?

Behind the procedure, the balance of power

An audit appears neutral to us because its vocabulary is. We speak of frameworks, of evidence, of non-conformities, of corrective actions. Everything seems to belong to an objective method whose conclusion would follow naturally from the facts observed.

Yet a control procedure never takes place outside the political and economic context in which it was decided.

The DGSI says so bluntly: these audits, "generally requested by government authorities as part of regulatory procedures, may also result from requests by competing companies".

What I take from this: the official procedure can be diverted in order to capture know-how, to slow a rival down, or to force it to expose itself.

Since it is the authority that audits, and that determines the information it wishes to obtain, the power sits on the other side and the balance of forces is uneven.

The two other examples reported by the DGSI illustrate precisely this risk: an audit tied to an export licence drags the timescales out to the point of leaving a factory facing a supply shortage, and in the other case, a compliance inspection results in modification requirements heavy enough to destabilise the company concerned.

The information that an audit makes it possible to obtain is considerable: the complete supply chain, the detail of industrial processes, the identity of those who hold the know-how, the architecture of a system, sometimes access to source code.

In this way, delaying a licence, suspending a delivery, drawing on the processes, taking the market, imposing costly modifications all become a reality within the economic and industrial balance of power.

In each of these situations, the company's cooperation is not enough to protect it. This obviously does not mean that every audit should be refused, or every certification suspected of being a hostile manoeuvre. It simply means that a technical tool can also carry a political function, and that it would be unwise to forget it.

The concrete cases

Without dwelling on the well-known examples of Alstom or BNP Paribas, concerning foreign interference that goes even further than simple audit procedures, there are a good number of concrete cases worth knowing.

The Micron affair, in China, is probably the clearest example of this shift.

In March 2023, the Cyberspace Administration of China opened a cybersecurity review into the products of the American memory manufacturer. Two months later, it announced that these products presented serious problems liable to threaten the supply chain of the country's critical infrastructure. The operators concerned were therefore ordered to stop buying them.

The regulator did not publish technical details precise enough to allow any assessment of the nature of the vulnerabilities found.

The decision also came amid strong tensions surrounding semiconductors, at a time when the United States had already tightened its restrictions on the export of advanced technologies to China.

It is hardly surprising, then, that it was widely interpreted as a retaliatory measure, even though the reason officially given remains that of cybersecurity. Here, a genuine security concern serves a broader economic strategy: the decision put at stake half of Micron's Chinese market, or around 12.5% of its worldwide revenue.

China had already raised concerns in 2015, when it sought to impose highly intrusive control rules on service providers in the banking sector, rules that amounted to leaving all know-how at the point of entry. The initiative was suspended that same year following significant diplomatic pressure.

A quick detour to our British neighbours brings us to the case of Huawei.

From 2010, the Chinese company submitted to British scrutiny for close to a decade. GCHQ (Government Communications Headquarters) and then the NCSC (National Cyber Security Center) examined the company's equipment, its source code and its engineering practices. In July 2020, the British services were not convinced and, under American pressure, Huawei was removed from the British 5G network.

The tools France has built

France is not defenceless, it holds several defensive regulatory instruments:

The blocking statute of 1968, for a long time almost never applied, was reformed in 2022 (decree no. 2022-207). It prohibits the disclosure to a foreign authority of sensitive information of an economic, commercial, industrial, financial or technical nature that touches on the essential interests of France. Since April 2022, a single point of contact, the SISSE (the strategic information and economic security service, attached to the DGE), issues an opinion within one month setting out what may or may not be disclosed (sources: economie.gouv.fr, DGE, DGSI).

To this judicial shield an infrastructure shield has been added. The cloud at the centre policy, set out by circular in 2021 and updated in 2023, requires public administrations to host their digital projects on the state's internal clouds or on qualified commercial offerings.

For data of particular sensitivity, the offering chosen must hold the SecNumCloud qualification, or an equivalent European qualification, and must be immune to any unauthorised access by the public authorities of third states.

This qualification goes beyond technical measures, covering the legal control of the company, its personnel, the location of its activities and the legislation to which the service may be subject.

SecNumCloud constitutes, in this sense, a defensive instrument. It allows the state to define the conditions under which certain sensitive data may be entrusted to a provider, rather than accepting that the market or foreign powers alone determine the level of risk we ought to tolerate.

France then argued for the introduction of comparable criteria into the European cloud services certification scheme, EUCS, particularly at its highest level. These sovereignty criteria have never commanded consensus among member states. The scheme has been pending ever since.

Several member states and organisations representing European and foreign industrial interests opposed these criteria, which they considered protectionist and alien to a certification that was supposed to remain purely technical. Conversely, several European companies called for them to be retained, precisely because they held that the security of a cloud could not be separated from the law to which it is exposed.

The United States, for its part, does not hesitate: its FedRAMP programme has for years made access to the federal market for cloud services conditional on a certification that it controls.

This debate says a great deal about our collective difficulty. At the very moment when we were seeking to define the conditions of trust applicable to our own market, we hesitated to accept that a certification might also express a sovereignty choice. To return to the image of the weapon, we began by blunting it ourselves. The reality is that we have not managed to equip ourselves with the safeguards needed in the face of the compliance instruments of non-European countries.

Their function is defensive, they are ramparts. Unlike the FCPA and OFAC, which are instruments of projection: they go and find the foreign company on its own ground.

From compliance endured to reciprocity

Two thousand four hundred years ago, Thucydides staged the Melian dialogue. Athens wants to subjugate the small island of Melos, which appeals to law and justice. The Athenians' reply has remained famous: "the strong do what they can and the weak suffer what they must".

The idea is not to devalue the usefulness of compliance and of law, nor to call open markets into question. It is to recall that being in order does not guarantee being protected. Law does not defend itself: it only truly protects where a public authority is prepared to enforce it.

For as long as the asymmetry in means of pressure exists, the most aggressive actor will keep its advantage. If access to a foreign market entails handing over source code or opening up one's factories, we must be able to demand comparable guarantees.

It is time to add a principle that the European Union and its member states have recently begun to establish, but still hesitate to assume fully: reciprocity in their regulatory framework, faced with the offensive legal instruments of third countries.

— Darya KHENDRIK, Compliance Manager at Clever Cloud, IMS lead (Integrated Management System) and DPO

Sources

]]> 2026.08.26 Clever Cloud Bannière Blog Audit Comme Arme EN

The story is that of a French company engaged in a commercial dispute with a local competitor, abroad. The authorities of the country decide to launch an audit and the company, anxious to be beyond reproach, agrees to hand over financial data as well as information on its manufacturing processes.

The result: the company is hit with a surcharge all the same, then loses the majority of its customers to the competitor that had reported it. In the meantime, it has handed over valuable economic information which, for its part, can never be taken back.

This case led me to consider a dimension of compliance that we do not discuss enough for my liking. We generally regard it as a way of reducing risk, protecting the company and establishing trust.

But what happens when the tools of compliance (the audit, the inspection, the certification) stop being safeguards and become weapons of economic warfare?

Behind the procedure, the balance of power

An audit appears neutral to us because its vocabulary is. We speak of frameworks, of evidence, of non-conformities, of corrective actions. Everything seems to belong to an objective method whose conclusion would follow naturally from the facts observed.

Yet a control procedure never takes place outside the political and economic context in which it was decided.

The DGSI says so bluntly: these audits, "generally requested by government authorities as part of regulatory procedures, may also result from requests by competing companies".

What I take from this: the official procedure can be diverted in order to capture know-how, to slow a rival down, or to force it to expose itself.

Since it is the authority that audits, and that determines the information it wishes to obtain, the power sits on the other side and the balance of forces is uneven.

The two other examples reported by the DGSI illustrate precisely this risk: an audit tied to an export licence drags the timescales out to the point of leaving a factory facing a supply shortage, and in the other case, a compliance inspection results in modification requirements heavy enough to destabilise the company concerned.

The information that an audit makes it possible to obtain is considerable: the complete supply chain, the detail of industrial processes, the identity of those who hold the know-how, the architecture of a system, sometimes access to source code.

In this way, delaying a licence, suspending a delivery, drawing on the processes, taking the market, imposing costly modifications all become a reality within the economic and industrial balance of power.

In each of these situations, the company's cooperation is not enough to protect it. This obviously does not mean that every audit should be refused, or every certification suspected of being a hostile manoeuvre. It simply means that a technical tool can also carry a political function, and that it would be unwise to forget it.

The concrete cases

Without dwelling on the well-known examples of Alstom or BNP Paribas, concerning foreign interference that goes even further than simple audit procedures, there are a good number of concrete cases worth knowing.

The Micron affair, in China, is probably the clearest example of this shift.

In March 2023, the Cyberspace Administration of China opened a cybersecurity review into the products of the American memory manufacturer. Two months later, it announced that these products presented serious problems liable to threaten the supply chain of the country's critical infrastructure. The operators concerned were therefore ordered to stop buying them.

The regulator did not publish technical details precise enough to allow any assessment of the nature of the vulnerabilities found.

The decision also came amid strong tensions surrounding semiconductors, at a time when the United States had already tightened its restrictions on the export of advanced technologies to China.

It is hardly surprising, then, that it was widely interpreted as a retaliatory measure, even though the reason officially given remains that of cybersecurity. Here, a genuine security concern serves a broader economic strategy: the decision put at stake half of Micron's Chinese market, or around 12.5% of its worldwide revenue.

China had already raised concerns in 2015, when it sought to impose highly intrusive control rules on service providers in the banking sector, rules that amounted to leaving all know-how at the point of entry. The initiative was suspended that same year following significant diplomatic pressure.

A quick detour to our British neighbours brings us to the case of Huawei.

From 2010, the Chinese company submitted to British scrutiny for close to a decade. GCHQ (Government Communications Headquarters) and then the NCSC (National Cyber Security Center) examined the company's equipment, its source code and its engineering practices. In July 2020, the British services were not convinced and, under American pressure, Huawei was removed from the British 5G network.

The tools France has built

France is not defenceless, it holds several defensive regulatory instruments:

The blocking statute of 1968, for a long time almost never applied, was reformed in 2022 (decree no. 2022-207). It prohibits the disclosure to a foreign authority of sensitive information of an economic, commercial, industrial, financial or technical nature that touches on the essential interests of France. Since April 2022, a single point of contact, the SISSE (the strategic information and economic security service, attached to the DGE), issues an opinion within one month setting out what may or may not be disclosed (sources: economie.gouv.fr, DGE, DGSI).

To this judicial shield an infrastructure shield has been added. The cloud at the centre policy, set out by circular in 2021 and updated in 2023, requires public administrations to host their digital projects on the state's internal clouds or on qualified commercial offerings.

For data of particular sensitivity, the offering chosen must hold the SecNumCloud qualification, or an equivalent European qualification, and must be immune to any unauthorised access by the public authorities of third states.

This qualification goes beyond technical measures, covering the legal control of the company, its personnel, the location of its activities and the legislation to which the service may be subject.

SecNumCloud constitutes, in this sense, a defensive instrument. It allows the state to define the conditions under which certain sensitive data may be entrusted to a provider, rather than accepting that the market or foreign powers alone determine the level of risk we ought to tolerate.

France then argued for the introduction of comparable criteria into the European cloud services certification scheme, EUCS, particularly at its highest level. These sovereignty criteria have never commanded consensus among member states. The scheme has been pending ever since.

Several member states and organisations representing European and foreign industrial interests opposed these criteria, which they considered protectionist and alien to a certification that was supposed to remain purely technical. Conversely, several European companies called for them to be retained, precisely because they held that the security of a cloud could not be separated from the law to which it is exposed.

The United States, for its part, does not hesitate: its FedRAMP programme has for years made access to the federal market for cloud services conditional on a certification that it controls.

This debate says a great deal about our collective difficulty. At the very moment when we were seeking to define the conditions of trust applicable to our own market, we hesitated to accept that a certification might also express a sovereignty choice. To return to the image of the weapon, we began by blunting it ourselves. The reality is that we have not managed to equip ourselves with the safeguards needed in the face of the compliance instruments of non-European countries.

Their function is defensive, they are ramparts. Unlike the FCPA and OFAC, which are instruments of projection: they go and find the foreign company on its own ground.

From compliance endured to reciprocity

Two thousand four hundred years ago, Thucydides staged the Melian dialogue. Athens wants to subjugate the small island of Melos, which appeals to law and justice. The Athenians' reply has remained famous: "the strong do what they can and the weak suffer what they must".

The idea is not to devalue the usefulness of compliance and of law, nor to call open markets into question. It is to recall that being in order does not guarantee being protected. Law does not defend itself: it only truly protects where a public authority is prepared to enforce it.

For as long as the asymmetry in means of pressure exists, the most aggressive actor will keep its advantage. If access to a foreign market entails handing over source code or opening up one's factories, we must be able to demand comparable guarantees.

It is time to add a principle that the European Union and its member states have recently begun to establish, but still hesitate to assume fully: reciprocity in their regulatory framework, faced with the offensive legal instruments of third countries.

— Darya KHENDRIK, Compliance Manager at Clever Cloud, IMS lead (Integrated Management System) and DPO

Sources

]]>