Corporate Governance Framework Design

It is the complete set of documents and practices — a Board Charter, committee charters, a Delegation of Authority matrix, a Related Party Transaction Policy, a Risk Management Policy, a Whistleblower Policy, and a Code of Conduct — that together define who in your company can decide what, how significant transactions are approved and disclosed, and how risk is identified and escalated to the Board. It converts abstract Companies Act and SEBI LODR obligations into documents your company actually uses to run itself.

It depends on your stage and thresholds. If your paid-up capital, turnover, or borrowings cross the levels prescribed under Sections 149, 177, and 178 of the Companies Act, mandatory committees and independent directors are triggered regardless of listing status. Even below those thresholds, any company planning institutional funding, an eventual IPO, or professionalising ahead of a leadership transition benefits significantly from a documented framework — investors and acquirers assess governance maturity as part of due diligence.

Under Section 149(4) read with Rule 4 of the Companies (Appointment and Qualification of Directors) Rules, 2014, public companies crossing prescribed paid-up share capital, turnover, or aggregate outstanding loans/borrowings/debentures/deposits thresholds must appoint at least 2 independent directors. Section 177 mandates an Audit Committee for the same category of companies once thresholds are crossed. Private companies are generally exempt from these specific triggers unless they are subsidiaries of a public company that itself meets the thresholds.

A DoA matrix is a structured document mapping specific financial and operational decisions — payment approvals, vendor contracts, capital expenditure, hiring above a salary band, real estate leases — to the designation or individual authorised to approve them, often on a tiered basis (e.g., CFO up to Rs 25 lakh, CEO up to Rs 1 crore, Board above that). It is the single most operational document in a governance framework because it is used daily, not just referenced at Board meetings.

A related party, under Section 2(76) of the Companies Act (and more broadly under SEBI LODR Regulation 2(1)(zb) for listed companies), includes directors, key managerial personnel, their relatives, and entities in which they or the promoter group hold significant influence or control. Section 188 requires Board (and in some cases shareholder) approval for specified RPTs, and pricing must be at arm's length. A documented RPT Policy with clear materiality thresholds ensures these transactions are identified, priced defensibly, and approved before execution — not discovered and justified after the fact.

Secretarial compliance — Board meeting notices, minutes, annual filings, statutory registers — is necessary but procedural. Governance framework design addresses the substance behind those procedures: what should the Board actually be deciding, what should be delegated, how should risk and related-party exposure be identified and escalated, and whether the committee structure reflects real oversight or exists only on paper. PNPC works alongside your Company Secretary — we design the framework; ongoing secretarial compliance keeps it correctly filed and documented.

The most common findings in our experience: no documented DoA (authority is informal), an RPT policy that exists on paper but was never applied to actual intercompany transactions, a Board that meets the statutory minimum of 4 times a year but exercises no real oversight of strategy or risk, and no independent Board perspective at all. Investors read these as signals of execution risk beyond the specific gap itself — if governance discipline is weak, diligence teams look harder at financial and operational claims too.

Under Section 135 of the Companies Act 2013, a CSR Committee and CSR spending obligation is mandatory for any company that, in the immediately preceding financial year, had a net worth of Rs 500 crore or more, turnover of Rs 1,000 crore or more, or net profit of Rs 5 crore or more. If the company ceases to meet any of these thresholds for three consecutive financial years, the CSR Committee is not mandatory and the CSR provisions do not apply until the thresholds are met again.

A Non-Executive Director is simply a director who is not involved in day-to-day management — this could include a promoter's family member or a nominee of an investor. An Independent Director must additionally satisfy the specific independence criteria under Section 149(6) — no pecuniary relationship with the company or its promoters beyond permitted director remuneration, no relative who is or was a KMP or employee in specified periods, no material pecuniary relationship with the company's auditors or advisors, and other conditions. Only a genuinely independent director qualifies for statutory Audit Committee and Independent Directors' roles under the Act.

Yes. Under the Companies (Appointment and Qualification of Directors) Rules, every individual intending to be appointed as an Independent Director of a company must register with the Indian Institute of Corporate Affairs (IICA) databank, and — unless exempted based on years of prior relevant experience — must pass the online proficiency self-assessment test within the prescribed period from the date of inclusion in the databank.

The SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015 apply once a company's equity shares (or other specified securities) are listed on a recognised stock exchange. From the date of listing, the company must comply with the full LODR framework — Board composition (Regulation 17), Audit Committee (Regulation 18), Nomination & Remuneration Committee (Regulation 19), related-party transaction approval and disclosure (Regulation 23), the annual Corporate Governance Report (Schedule V), and a substantial set of continuous and periodic disclosure obligations to the stock exchanges.

A Vigil Mechanism under Section 177(9) of the Companies Act is mandatory for listed companies and for companies that accept deposits from the public or have borrowed money from banks and public financial institutions in excess of prescribed limits. It provides directors and employees a channel to report genuine concerns about unethical behaviour, fraud, or violation of the company's Code of Conduct, with protection against victimisation and, in appropriate cases, direct access to the Audit Committee Chairperson.

PNPC scopes each engagement based on company stage, whether the framework must be SEBI LODR-compliant (listed or IPO-bound) or Companies Act-baseline (private/unlisted public), the number of committees and policies required, and whether historical related-party transactions need to be reviewed and regularised as part of the work. A fixed fee is confirmed in writing after the initial diagnostic — before drafting begins.

PNPC's role is advisory — we design your governance framework, support committee functioning, and provide ongoing CA/CS guidance. We generally do not serve as independent directors on client Boards, as this can create a conflict between our advisory and audit-adjacent roles and the fiduciary duties of a sitting director. We can, however, assist you in identifying, vetting, and onboarding suitable independent director candidates from our professional network.

Board Evaluation is a structured annual assessment of the performance of the Board as a whole, its committees, and individual directors — typically conducted through a questionnaire or facilitated discussion covering strategic oversight, risk management, and governance effectiveness. It becomes a formal requirement once independent directors are appointed under Schedule IV of the Companies Act, and is mandatory with detailed disclosure requirements for listed companies under SEBI LODR.

This is one of the most common triggers for engagement. A Board Charter and DoA clarify, in writing, exactly what decisions remain with the founder/promoter Board versus what is delegated to the new CEO and their management team — preventing the common friction of a professional CEO being hired with an implied mandate that the founder then informally overrides. It also typically surfaces related-party arrangements (family members on payroll, shared premises, intercompany loans) that need to be formalised or unwound before an outside CEO takes charge.

You will likely remain in technical compliance for routine filings, but you accumulate governance risk that surfaces at the worst possible moment — during investor due diligence, at the point of a related-party dispute, when a whistleblower complaint has nowhere formal to go, or when SEBI or a stock exchange queries your Corporate Governance Report post-listing. The risk is not usually an immediate penalty; it is a compounding structural weakness that becomes expensive to fix under external pressure or deadline.

The NRC, under Section 178, is responsible for formulating the criteria for determining qualifications, positive attributes, and independence of directors, recommending a policy on remuneration for directors, KMP, and senior management, and — for listed companies — devising a policy on Board diversity and carrying out performance evaluation. It sets the policy and framework for remuneration decisions; it does not necessarily negotiate every individual employment contract, though for KMP and director remuneration, its recommendation is a required step before Board approval.

Market practice — reinforced by the Secretarial Standards and, for listed companies, SEBI LODR Regulation 18 — is for the Audit Committee to meet at least 4 times a year (aligned with quarterly financial reporting where applicable), with the gap between two meetings not exceeding 120 days. Its remit includes reviewing financial statements before Board approval, overseeing the statutory auditor's independence and scope, reviewing internal financial controls and internal audit findings, examining related-party transactions, and reviewing whistleblower complaints referred to it.

Primarily the quarterly Corporate Governance Report filed under LODR Regulation 27, the Annual Report's Corporate Governance section (Schedule V), related-party transaction disclosures filed under Regulation 23(9), the Secretarial Audit Report and Secretarial Compliance Report, disclosures of Board and committee composition changes, and any material event disclosures under Regulation 30. Persistent gaps or inconsistencies across these filings are what typically trigger a stock exchange query or SEBI scrutiny.

Yes, materially. RBI's governance guidelines for NBFCs (including the Scale Based Regulation framework), IRDAI's corporate governance guidelines for insurance intermediaries, and SEBI's specific requirements for market intermediaries each layer additional, sector-specific governance requirements on top of the Companies Act baseline — often including fit-and-proper criteria for directors, additional committees (e.g., a Risk Management Committee mandated at a lower threshold for NBFCs than the general LODR requirement), and sector-specific disclosure obligations.

Yes — over-engineering governance for a 5-person, pre-revenue startup wastes management time on committee meetings and approval layers the business does not yet need. PNPC scopes the framework to the company's actual stage: an early-stage company typically gets a lightweight Board Charter and a simple DoA; the full committee suite and LODR-grade policies are built only as the company approaches the thresholds or funding stage that actually require them.

The SHA is a private contract between specific shareholders that often includes investor rights — Board seats, veto rights on specified matters, information rights — that must be reflected in the Board Charter's reserved matters list and, where relevant, the Articles of Association. A governance framework that contradicts SHA-agreed rights creates both a breach-of-contract risk with investors and internal confusion about which document governs. We reconcile the two explicitly as part of framework design.

Mandatory for listed companies under SEBI LODR Regulation 30, this policy defines what constitutes a 'material event' (M&A, change in KMP, litigation above a threshold, credit rating change, and a list of deemed-material events) that must be disclosed to stock exchanges within prescribed timelines — typically within 24 hours for most events, with a narrower window for specified categories. The policy also designates the Key Managerial Personnel responsible for determining materiality and authorising disclosure.

For the top 1,000 listed companies by market capitalisation, SEBI mandates a Business Responsibility and Sustainability Report (BRSR) under LODR Regulation 34, which requires structured ESG disclosure including governance-specific metrics. For companies outside this bracket, ESG reporting is not currently mandatory but is increasingly expected by institutional investors, larger enterprise customers, and export markets with ESG-linked supply chain requirements.

The Board approves the governance framework and is ultimately accountable for its effectiveness. The Company Secretary, as the compliance officer under the Companies Act, is typically responsible for the administrative implementation — scheduling committee meetings per the charter, ensuring proper notice and quorum, maintaining minutes and statutory registers reflecting the framework's operation, and flagging when practice deviates from the documented policy.

PNPC's Chennai, Bangalore, Hyderabad, and Dubai offices coordinate on cross-border governance design. The Indian entity's framework is built against the Companies Act 2013 and, if applicable, SEBI LODR. The UAE entity's governance is separately assessed against the relevant Free Zone authority or Mainland Commercial Companies Law requirements. Where the two entities have common directors, shared services, or intercompany transactions, we build a consistent related-party transaction and conflict-of-interest framework across both, coordinated from a single engagement rather than two disconnected advisors.

Under SEBI LODR Regulation 21, a Risk Management Committee is mandatory for the top 1,000 listed entities by market capitalisation, and for certain categories of NBFCs and other regulated entities under sector-specific RBI or SEBI guidelines. Outside these categories, it is not statutorily mandatory, but many companies choose to establish a Risk Management Committee or assign its function to the Audit Committee as a matter of good governance practice, particularly once the business has meaningful operational, credit, or regulatory risk exposure.

A health check is a shorter diagnostic engagement — we review existing policies, Board minutes, and committee practice against statutory and investor-grade benchmarks, and produce a gap report with prioritised recommendations, without drafting the full policy suite. A full design engagement includes the health check as its first phase, followed by drafting every required document, building the DoA and RPT workflows, and supporting first-cycle implementation.

Yes, and they should be — a governance framework is not a static, one-time document. Board Charters, committee charters, and policies are typically reviewed annually (and are formally required to be reviewed periodically under SEBI LODR for listed entities) and amended as the company's stage, thresholds, shareholding, or regulatory environment changes. Amendments are approved by Board resolution and, for policies required to be shareholder-approved or disclosed, updated on the company website and in the next Annual Report.

Beyond the statutory exposure under Section 188 (which can include the transaction being voidable at the option of the Board, and liability for the interested director), the practical costs are often larger: a due diligence red flag that reduces valuation or delays a funding round, minority shareholder disputes if an RPT is later seen as favouring the promoter, and — for listed companies — proxy advisory firm objections at the AGM that can result in shareholders voting down RPT-related resolutions.

In-house teams are well-placed to implement and maintain a governance framework, but designing one requires calibrating it against Companies Act thresholds that change with your financials, SEBI LODR requirements if you are listed or listing-bound, sector-specific regulatory overlays, and the specific expectations of the investors or acquirers you are preparing for — a breadth of comparative experience across many companies at similar stages that is hard to replicate from inside a single company. PNPC brings that comparative pattern recognition, plus integrated CA and CS expertise so the governance framework and the tax/financial-reporting implications of related-party transactions and remuneration structuring are addressed together.

With annual review and incremental updates, a well-designed framework can scale with the company for several years. A significant rebuild is usually triggered by a step-change event — crossing a major statutory threshold, a new funding round with materially different investor rights, an IPO process commencing, or a sector regulatory change — rather than by simple time elapsed.