Enterprise Risk Management (ERM)

It is a structured way for an organisation to answer three questions on an ongoing basis: what could go wrong across the business (not just in finance, but strategy, operations, compliance, technology, and reputation), how likely and how damaging is each of those risks, and what is the organisation actually doing about the ones that matter most. Instead of each department worrying about its own risks in isolation, ERM gives the Board and management one integrated view — typically captured in a risk register and reported through a Risk Management Committee.

A Board-level Risk Management Committee and a documented risk management policy are mandatory under Regulation 21 of the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015, for the top 1,000 listed companies by market capitalisation. Separately, Section 134(3)(n) of the Companies Act 2013 requires every listed company's Board's Report to include a statement on the development and implementation of a risk management policy. Companies outside these thresholds are not statutorily required to run a formal ERM programme, but increasingly face expectations from investors, lenders, rating agencies, and — for regulated sectors like NBFCs, banks, and insurers — sector regulators.

Both are internationally recognised, principles-based reference frameworks rather than rigid checklists. ISO 31000:2018 is a generic risk management standard applicable to any organisation, structured around principles, a framework, and a process (identify, analyse, evaluate, treat, monitor). COSO ERM (2017) is more explicitly linked to strategy and performance, and is widely used by companies with US-linked governance expectations or those benchmarking against COSO's earlier Internal Control Integrated Framework used for IFC purposes. Neither is mandated by Indian law by name — SEBI and the Companies Act require the outcome (a documented, Board-approved risk management policy and process) without prescribing a specific named framework.

No — they are complementary but distinct. ERM identifies, assesses, and prioritises the full universe of risks the organisation faces and defines how those risks will be treated. Internal Audit independently tests whether the controls that exist to manage specific risks are actually designed correctly and operating effectively, and reports rated findings to the Audit Committee. In a mature governance structure, the ERM risk register directly informs the internal audit plan — audit hours get allocated to the highest-priority risk areas identified through ERM, rather than the two functions working from separate, disconnected risk views.

Under Regulation 21 of SEBI LODR, the Risk Management Committee must have a majority of members from the Board of Directors, with the Chairperson being a member of the Board. The Committee is responsible for formulating and approving the risk management policy, ensuring the policy addresses cybersecurity risk specifically, monitoring and reviewing the risk management plan, and reporting to the Board at intervals it determines. For companies not statutorily required to constitute this Committee, a management-level risk committee reporting into the Audit Committee is a common lighter-touch alternative.

A risk register is the structured, working document at the heart of any ERM programme. At minimum, each entry should include: a clear risk description, the risk category (strategic, operational, financial, compliance, reputational, technology), the risk owner (a named individual, not a department), the inherent risk score (likelihood x impact before controls), a description of existing controls, the residual risk score (after existing controls), and a treatment plan with actions, owner, and target date for any risk above the organisation's tolerance threshold.

Risk appetite is inherently a Board-level judgement about how much risk the organisation is willing to accept in pursuit of its objectives — it cannot be derived purely mathematically. However, the process of setting it can and should be structured: facilitated Board discussion informed by the organisation's financial capacity to absorb loss, regulatory constraints, stakeholder expectations, and strategic priorities, translated into concrete tolerance thresholds (for example, maximum acceptable customer concentration, or a defined threshold for cybersecurity incident impact) that then anchor the likelihood/impact scoring scale used across the risk register.

It depends on your investor base, lending relationships, and growth trajectory rather than listing status alone. Private equity and venture capital investors increasingly expect a documented risk register as part of governance reporting, even pre-IPO. Lenders and rating agencies factor risk management maturity into credit assessments. And practically, a structured risk view helps management make better resource-allocation decisions regardless of any external requirement. For a small, single-location private company with no institutional capital and no near-term listing or fundraising plans, a full ERM programme is often disproportionate — a lighter annual risk discussion as part of strategic planning may suffice.

A Key Performance Indicator (KPI) measures how well the organisation is performing against its objectives. A Key Risk Indicator (KRI) is an early-warning metric that signals a specific risk is trending toward materialisation — for example, rising customer concentration percentage, increasing days-sales-outstanding as an early signal of credit risk, or a rising rate of failed login attempts as a cybersecurity indicator. KRIs are deliberately forward-looking and tied to specific risks in the register, giving management a chance to intervene before the risk actually crystallises into a loss event.

The DPDP Act, 2023 creates new compliance obligations around personal data processing, consent, data breach notification, and significant penalties for non-compliance, making data privacy and cybersecurity a materially heightened risk category within any current ERM framework. Organisations processing personal data at scale should specifically assess data privacy risk — including third-party data processor risk — as part of the risk universe, with rules and detailed compliance timelines being operationalised progressively. We build DPDP-related risk assessment into current ERM engagements rather than treating it as a separate compliance exercise.

Increasingly, yes. SEBI's Business Responsibility and Sustainability Reporting (BRSR) framework applies to the top 1,000 listed companies by market capitalisation, requiring disclosure across environmental, social, and governance parameters, and climate-related risk (physical and transition risk) is now a recognised category within a comprehensive ERM risk universe for applicable companies. For companies not currently subject to BRSR, we typically still recommend identifying material ESG-linked risks — such as regulatory tightening, supply-chain sustainability expectations from large customers, or physical climate exposure for asset-heavy businesses — as part of a forward-looking risk register.

For a single-entity company with reasonably available process documentation, a realistic timeline from initial stakeholder interviews through a Board-approved risk management policy and an operational risk register is 8-12 weeks. Multi-entity groups, cross-border operations, or organisations with limited existing documentation typically take longer. The framework itself is not a one-time deliverable — ongoing quarterly reporting, KRI monitoring, and an annual formal refresh are what make the difference between a framework that is used and one that becomes a filed document.

Cost depends materially on company size, number of entities and locations in scope, sector complexity, and whether a Risk Management Committee and reporting cadence need to be stood up from scratch or already exist in some form. PNPC agrees a fixed, written scope and fee before any engagement begins — covering the framework design phase distinctly from any ongoing quarterly support retainer, so you know exactly what is included at each stage.

For companies within the top 1,000 listed entities or those with a genuinely complex risk profile, a dedicated Chief Risk Officer or equivalent full-time risk function is common practice. For most mid-sized and smaller companies, day-to-day risk register ownership can sit with an existing function — often the CFO, Company Secretary, or Head of Internal Audit — supported by named risk owners across the business for individual risks, with PNPC providing periodic advisory support and facilitation for the formal review cycles rather than a full-time in-house hire.

The statutory auditor's primary responsibility is an opinion on whether the financial statements present a true and fair view, and — as part of that — an assessment of Internal Financial Controls over financial reporting under Section 143(3)(i). A well-documented ERM framework and risk register can support the statutory audit process by demonstrating Board-level risk oversight and providing context for the auditor's own risk assessment, but ERM is a broader, forward-looking management discipline, not a substitute for the auditor's independent testing.

This is one of the most common failure modes in ERM implementations — a policy is adopted and a register is built to satisfy the Section 134(3)(n) disclosure requirement, but the Board treats quarterly risk reporting as a formality rather than substantively engaging with it. Beyond the governance weakness this creates, it exposes the company to criticism during due diligence, rating reviews, or — in a worst case — after an actual risk event materialises and it becomes evident the risk was on the register but never meaningfully treated.

Yes, materially. Institutional investors and IPO due diligence teams routinely review risk governance maturity as part of their assessment — a documented risk register, evidence of Board-level risk oversight, and a track record of quarterly reporting all demonstrate governance readiness and can reduce the scope of investor-side risk queries during diligence. Conversely, the absence of any documented risk process, discovered for the first time during diligence, often triggers additional queries, extended timelines, or valuation-related conversations.

For NBFCs, the risk universe must specifically address RBI's risk-based supervision expectations, asset-liability mismatch risk, credit concentration risk, provisioning adequacy under Ind AS 109 (Expected Credit Loss model), liquidity risk, and — depending on the NBFC's scale-based regulatory layer under RBI's Scale Based Regulation framework — enhanced governance requirements including a mandatory Risk Management Committee for upper-layer NBFCs.

For RERA-registered developers, the risk universe should specifically address project completion and delay risk, escrow account compliance under Section 4(2)(l)(D) of the RERA Act (70% of project receivables to be maintained in a designated account for project costs), title and approval risk, and litigation risk from homebuyer associations — categories that a generic, non-sector-specific ERM template typically misses entirely.

Fraud risk is one category within the broader ERM risk universe, typically assessed through a structured fraud risk assessment covering opportunity, pressure, and rationalisation factors (the fraud triangle), and mapped against existing anti-fraud controls, whistle-blower mechanisms, and segregation-of-duties design. Where a specific fraud is suspected or has occurred, that requires a separate, targeted forensic investigation — ERM's fraud risk assessment is preventive and diagnostic, not investigative.

A documented cybersecurity risk assessment — part of the technology risk category within ERM — directly supports the cyber insurance underwriting process, since insurers increasingly require evidence of the applicant's risk management maturity, existing controls, and incident response readiness before quoting or renewing cover. A well-articulated risk register and treatment plan for cyber risk can materially influence both the availability and the pricing of cyber insurance cover.

The risk register should be a living document, ideally reviewed at every quarterly Risk Management Committee or management risk committee meeting for material changes, with a comprehensive formal refresh — reassessing the full risk universe, appetite statement, and heat map — at least annually, and immediately following any significant risk event, acquisition, new market entry, or major regulatory change.

Yes. PNPC operates from Chennai, Bangalore, Hyderabad, and Dubai. For groups with both Indian and UAE entities, we build a consolidated, group-level risk view that captures cross-border risk correlation — currency and FEMA/ODI-related risk, UAE Corporate Tax and VAT compliance risk, and jurisdiction-specific regulatory risk — rather than running two disconnected, entity-level frameworks that miss how risk in one jurisdiction can affect the other.

Inherent risk is the level of risk before considering any existing controls or mitigations. Residual risk is what remains after existing controls are factored in. The distinction matters because a risk with very high inherent severity but strong, well-tested existing controls may have low residual risk and require only monitoring — while a risk with moderate inherent severity but weak or absent controls may have high residual risk and require urgent treatment. Prioritising treatment purely on inherent risk, without assessing residual risk, misdirects resources toward risks that are already well-managed.

Informal Board-level risk discussion is valuable but is not a substitute for a structured framework, for three reasons: it typically covers only the risks that happen to be top-of-mind that quarter, it lacks a consistent scoring methodology that allows risks to be compared and prioritised objectively, and — for companies within the LODR Regulation 21 threshold — it does not satisfy the specific governance and disclosure requirements around a constituted Risk Management Committee and documented policy.

Bow-tie analysis is a visual risk assessment technique that maps a specific risk event at the centre, with the causes (threats) leading into it on one side and the consequences leading out of it on the other, alongside the preventive controls (addressing causes) and mitigating controls (limiting consequences) at each point. It is particularly useful for a small number of high-severity, well-defined risks — such as a major cybersecurity breach or a critical facility failure — where understanding the full causal chain and control points in detail adds more value than a simple likelihood/impact score.

There is no statutory requirement for an unlisted company below the relevant thresholds to have a written risk management policy. That said, a concise, Board-discussed risk policy — even a few pages — creates useful discipline: it forces agreement on what categories of risk matter most, who owns identifying and escalating them, and what the Board expects to be told and when. Many of our unlisted clients adopt a lighter-weight version of the same structure used for listed clients, scaled to their governance maturity.

Most well-designed risk registers allow a single risk to be tagged against a primary category with cross-references to secondary categories it touches, rather than forcing an artificial single classification. The more important discipline is ensuring the risk owner and treatment plan account for the full breadth of impact — a key-customer concentration risk, for example, should have its financial impact (revenue loss), strategic impact (market positioning), and operational impact (capacity planning) all considered in the treatment plan, even if it is tracked under a single primary heading for reporting simplicity.

A concise reporting pack — typically the top-tier risk heat map, a summary of any newly identified or materially changed risks since the last review, progress against open treatment plans for high-priority risks, relevant Key Risk Indicator trends, and any risk events that occurred in the period along with lessons incorporated into the register. This is deliberately shorter than the full underlying risk register, which management retains and maintains between formal Board cycles.

Both models are available. Many clients engage PNPC for the initial framework design as a defined project, then transition to a lighter-touch quarterly advisory retainer — supporting Committee meeting preparation, KRI dashboard review, and the annual comprehensive refresh — while day-to-day risk register maintenance is handled internally. Some clients, particularly those without an internal risk function, prefer PNPC to remain more actively involved in ongoing risk register updates between formal cycles.

ERM principles scale down meaningfully — the core discipline of identifying, prioritising, and treating risk with named ownership is valuable for a mid-sized business, even without the full Committee governance structure that applies to large listed companies. The practical difference is in scope and formality: a mid-sized private company might run a lighter annual risk workshop and a management-level (rather than Board sub-committee) review, while retaining the same underlying rigour in how risks are identified and tracked.

Treating it as a one-time documentation exercise to satisfy a disclosure requirement rather than a living management tool. The symptoms are consistent: a risk register produced once, presented once, and never substantively revisited; generic risks copied from a template rather than reflecting the organisation's actual exposure; and no named ownership or treatment plan attached to identified risks. The framework technically exists, satisfies the paperwork, and delivers essentially no risk-management value.