Risk managers in high demand as Sebi wants another 1,000 companies to tighten control

Mint spoke to consultancy and compliance experts who told them that companies are upping their teams of RMCs which include auditors, cybersecurity and geopolitical experts.

To be clear, RMCs are responsible for pre-empting, evaluating and mitigating risks that might affect the organization. This is different from a crisis management team which springs into action after the crisis happens.

Also read | RBI deputy governor urges banks to exercise prudent risk management

On 26 June, Sebi released a consultation paper seeking comments on recommendations given by an expert committee constituted in August 2023 and chaired by former Sebi Whole Time Member S.K. Mohanty on ease of doing business.

The recommendations included amendments to Sebi's Listing Obligations and Disclosure Requirements (LODR) regulations, aimed at strengthening corporate governance. One key proposal is extending the discretionary requirement to form RMCs to the top 2,000 listed entities.

Broader regulatory shift

Experts believe this move will provide companies with a valuable "outside-in" perspective, but they also view it as part of a broader regulatory shift where authorities are delving deeper into corporate operations and governance.

Consultancies that help companies establish RMCs stress that having a dedicated risk management committee, which reports directly to the Board of Directors, raises the committee’s profile to that of an audit committee. This not only sharpens the focus on risk management but also fosters a stronger risk-aware culture within the organization.

Also read | PSBs asked to focus on robust risk management practices

Siddharth Vishwanath, Partner and Risk Consulting Domestic Markets Leader at PwC India added that the growing cost of non-compliance and the extent of regulatory oversight was also changing. "Regulators today are looking more deeply into the functioning of companies and the repercussions of non-compliance are not limited to penalties alone", he said.

Cost to companies to form RMC

Experts agree that Sebi's mandate for the top 2,000 companies would increase costs, but believe the benefits would far outweigh them. Ketan Dalal, founder of Katalyst Advisors and a member of several RMCs, noted that the primary additional expense would be the “fees paid to committee members for meetings with the Board, which should hardly be a concern."

Laxmikant Gupta, Chartered Accountant and Principal at RiskPro India, a specialized risk management consultancy, highlighted that the 1,000th company on the list has a market capitalization of approximately ₹2,500 crores, while the 2,000th company’s market cap ranges between ₹200-250 crores. He pointed out that companies with a market cap over ₹200 crores are already required to conduct internal audits and could easily add two more officials to form an RMC.

“Risk management standards and approaches for banks are stricter with larger structures while non-banking listed companies need not be so structured. However, benefits of RMCs at the systemic level of the company will outpace the costs", Gupta said.

Gupta suggested that Sebi could consider targeting specific industries within the 1,000 to 2,000 range for mandatory RMCs, based on factors such as environmental impact, data privacy, affiliation with larger corporate groups, or being part of critical supply chains.

Purvi Mathur, managing partner at KP Associates, Advocates & Consultants, emphasized that companies integrating geopolitical risk management into their corporate governance structures would be better equipped to navigate the complexities of the global business environment and safeguard long-term shareholder value.

Geopolitical risks and how RMCs manage them

Geopolitical risks arise from wars, terrorism, and conflicts between nations, disrupting international business. Currency fluctuations and oil prices are key indicators of such risks.

Experts noted that industries with direct or indirect exposure to global economies are the most affected. Direct exposure examples include construction contracts in conflict zones like Afghanistan or Israel facing recovery issues, or profitable airline routes turning unviable due to geopolitical tensions and visa restrictions.

Indirect exposure can affect sectors such as education finance, where companies face risks from students stuck in conflict zones like Ukraine or visa delays, such as those applying for Canadian visas. However, geopolitical risks can also create opportunities, such as the boost to India's textile industry following the Bangladesh crisis.

Dalal from Katalyst Advisors explained that companies must prioritize geopolitical risk management, as it can lead to supply chain disruptions, reduced demand, and raw material shortages. "The risk owner would have to build scenarios to mitigate risks, which would be helpful to deal with the fallouts. A review by RMCs helps companies in getting 'outside in' perspective" he said.

Geopolitical experts

Gupta said that in the last five years, especially after covid-19 pandemic, geo-political expertise has emerged as a new era and few companies or groups have an Intelligence Department or chief economist, keeping the geo-political scenarios on the radar.

Vishwanath from PwC informed that they hired talent from technology institutes, leading graduate schools and B-schools. "We also have former defense personnel, regulators, bankers and other subject matter experts in PwC India’s Risk Consulting team with close to 5000 team members, growing at 30% y-o-y", he said.

And read | Economic growth faces risks from weather, geopolitics, global financial conditions: finance ministry

Manoj Kumar Vijai, partner and head, Risk Advisory at KPMG in India, said that a notable trend was the migration of industry executives to consulting roles, which brings in sector-specific expertise to enhance our service capabilities. “Industries under heavy regulation, such as financial services and pharmaceuticals, depend on specialized risk managers and as the complexity increases, even smaller organizations can no longer afford to have CIOs, CFOs, or other executives who double up as risk experts," he said.