1 – What French law already requires of you regarding your offshore value chain
You may think the duty of vigilance only applies to large corporations. That is true on the face of the 2017 law. It is false in the current legal trajectory. Three converging developments are extending your liability as an SME acting as a contracting authority.
1.1: The Duty of Vigilance Law and its extensions to SMEs
Law No. 2017-399 targets companies with more than 5,000 employees in France. But the European CS3D Directive (Corporate Sustainability Due Diligence Directive), adopted in 2024, lowers the thresholds. Eventually, companies with 250 employees and €40M in revenue will be in scope. And French case law is not waiting for transposition: several rulings have already held a contracting authority liable for working conditions at a subcontractor, even outside the strict legal perimeter.
For an SME with 10 to 50 employees, the immediate risk is not a conviction under the duty of vigilance. It is reputational risk and the loss of a B2B client who is themselves subject to these obligations and is asking you to prove compliance across your own chain. A lost tender because you cannot document the working conditions of your offshore team is revenue that disappears without a sound.
1.2: Growing B2B buyer expectations around supplier CSR
If you sell to mid-sized or large French companies, you have already seen supplier CSR questionnaires. These frameworks require you to document your social practices, including those of your subcontractors. A contracting authority subject to CSRD (mandatory non-financial reporting) must map the social and environmental risks across its value chain. You are part of that chain.
The practical consequence: if your offshore provider in Madagascar cannot provide evidence on salaries, working hours, social coverage or facility safety, you are the one who loses the contract. Not them. The pressure no longer comes from abstract ethics. It comes from your commercial pipeline. And it will only intensify as ESG criteria gain weight in B2B procurement processes.
1.3: What you concretely risk in the event of non-compliance
Three levels of risk. First level: loss of B2B contracts. A prospect rules you out because you cannot document your subcontracting chain. Second level: reputational risk. An offshore team member posts on LinkedIn or a forum about the actual working conditions at your provider. Screenshots, photos of the premises, pay slips. Within 48 hours, your employer brand is destroyed. Third level: litigation. Even outside the strict perimeter of the duty of vigilance, a court may hold you liable if you were aware of degraded practices and took no action.
To understand how to lock down the personal data dimension of your offshore relationship, see notre guide RGPD pour l'outsourcing hors UE. CSR compliance and data compliance go hand in hand.
2 – The 9-point remote CSR audit framework
An on-site audit costs between €3,000 and €8,000, excluding flights. You will not do it twice a year. Here are the 9 control points you can verify from your desk, with documentary evidence that can be requested by email or video call.
2.1: Employment contracts, salaries and social coverage
Request the following: a standard employment contract template (anonymised), a salary scale by role and experience level, proof of affiliation with CNaPS (Madagascar's National Social Provenance Fund) and a supplementary health provider. Require your provider to send you a CNaPS certificate dated within the last 3 months for each team member assigned to your account.
Compare the stated salaries against market data. A junior developer in Antananarivo earns between €400 and €700 gross per month in 2026. A profile at €250 signals either a very junior hire or a below-market practice. An ethical provider will share its salary scale without hesitation. One who refuses this transparency is hiding something. For a benchmarked breakdown of salaries by role, see notre grille salariale Madagascar 2026.
2.2: Working hours, overtime and leave
The Malagasy Labour Code sets the legal working week at 40 hours. Any overtime beyond this must be compensated at a premium rate. Ask your provider for their time-tracking tool (Toggl, Clockify, or an internal system), and request a monthly export of hours worked for your dedicated team members. A team member consistently logging 50 hours per week without overtime pay is a red flag.
Also check the leave policy: 2.5 working days per month worked under Malagasy law, plus national public holidays. If your provider advertises "365-day availability", they are either misrepresenting the conditions or denying their employees their legal rights. Request the calendar of non-working days for the current year. A well-structured provider supplies this proactively at the start of the contract.
2.3: Infrastructure, working environment and facility safety
Request a virtual tour of the premises via video call, unannounced (give a maximum of 24 hours' notice, not 2 weeks). Observe: does each team member have an individual workstation? Is the lighting adequate? Is air conditioning operational (in Antananarivo, heat has a direct impact on productivity)? Is there a break area? Are the restrooms accessible and clean?
Request the hardware specifications of workstations: processor, RAM, screen size, measured internet speed (not advertised). A provider running your developers on 4GB RAM machines with an unstable connection is stealing productivity from you while degrading working conditions. The two are directly linked. At Taram, every workstation is equipped with a Ryzen 7 processor, fibre connection and 5G backup, and these specifications are contractual and verifiable at any time.
3 – The 6 red flags that disqualify a provider without a site visit
Some signals are unmistakable. They require neither a formal audit nor a flight. They are visible in daily exchanges, contractual documents, and the responses — or non-responses — to your transparency requests.
3.1: Refusal of documentary transparency and evasive answers
First signal: you ask for a standard employment contract template and are told "it's confidential". An anonymised template contract has nothing confidential about it. Second signal: you ask for the salary scale and are told "it depends on the profiles" with no range ever given. Third signal: you ask for proof of CNaPS affiliation and receive a blurry or two-year-old document.
A provider who systematically refuses to supply documentary evidence of your dedicated team members' working conditions is not acting out of administrative modesty. They are doing so because reality does not match the sales pitch. Ask these questions before signing, not after. And record the responses in writing. In the event of a dispute or a CSR questionnaire from one of your own clients, these exchanges form your due diligence file. To lock these commitments in contractually, incorporate them into your clauses SLA avant signature.
3.2: Abnormal turnover and its hidden causes
An annual turnover rate above 25% for profiles assigned to your account is a reliable indicator of degraded working conditions, under-compensation, or both. Ask your provider for their overall turnover rate and the specific rate for profiles comparable to yours. Cross-reference with the average tenure of the team members presented to you.
If your provider has changed your dedicated team member for the third time in 12 months and cites "personal reasons" each time, dig deeper. Request a direct conversation with the outgoing team member before they leave, not after. Ask open questions about their reasons for leaving. An ethical provider facilitates this exchange. One who refuses is protecting their narrative, not their employees. The article sur le turnover offshore à Madagascar details the structural causes and the retention mechanisms that actually work.
3.3: Hidden resource pooling and undeclared night shifts
Is your "dedicated" team member actually working exclusively for you? Verify this: ask them directly on a video call, without their manager present, how many projects they are managing. Review their commit history, their login logs on your tools, and whether their production hours are consistent with the volume delivered. A profile supposedly working 8 hours a day for you but only producing 4 billable hours is likely serving another client with the remaining time.
Night shift work is the other invisible signal. Some providers schedule their teams on European hours (9am–6pm Paris time) without night-shift compensation, even though Madagascar is one to two hours ahead of France. The gap is small, but some providers also serve North American clients and rotate the same team members onto night shifts without premium pay. Ask for actual working hours, not advertised ones. And verify them through the timestamps in your collaboration tools.
Your value chain speaks for you, even when you are not watching
Every day you outsource without checking, you accumulate risk. Legal risk, reputational risk, commercial risk from your own clients who are starting to ask questions about your subcontracting chain.
The 9 control points in this article require neither a plane ticket nor an audit budget. They require emails, video calls, and the willingness to ask the uncomfortable questions. A provider who responds with evidence deserves your trust. A provider who deflects deserves your suspicion.
Taram provides every document mentioned in this article to its clients, without being asked. Because a dedicated team member working in good conditions produces better results. And because a business leader who can sleep soundly over their value chain makes better decisions.
Not auditing means accepting not knowing. And not knowing, in 2026, is a luxury your SME can no longer afford.
