—Guide
The Board's Role in Risk Management Under the Companies Act
What the Companies Act, 2013 and SEBI rules expect of boards on risk management — the board report statement, audit committee and independent director roles, and good practice.
Risk management isn't only good practice; Indian company law expects boards to engage with it. This guide sets out the key requirements and what they mean in practice.
The Board Report Statement
Under Section 134(3)(n) of the Companies Act, 2013, the board's report must include a statement indicating the development and implementation of a risk management policy for the company, including identification of elements of risk which, in the board's opinion, may threaten the existence of the company. This applies to every company that prepares a board's report, not only large or listed ones.
Internal Financial Controls
The directors' responsibility statement of listed companies covers internal financial controls, and the auditors of many companies report on the adequacy and operating effectiveness of internal financial controls over financial reporting. Controls and risk management go together.
Audit Committee
Where a company must have an audit committee under Section 177, its terms of reference include evaluating internal financial controls and risk management systems.
Independent Directors
The Code for Independent Directors in Schedule IV expects them to satisfy themselves that systems of risk management are robust and defensible.
Listed Companies
Under SEBI's Listing Regulations, the top 1,000 listed entities by market capitalisation must constitute a risk management committee, with a defined composition and a duty to formulate and monitor a detailed risk management policy, including cyber security. Check the current regulations for the precise requirements.
What Good Board Practice Looks Like
- Approve a risk management policy and risk appetite.
- Review the top risks at least half-yearly.
- Ask management for evidence that mitigation actions are progressing.
- Link internal audit plans to key risks.
- Discuss emerging risks, not just known ones.
- Minute the discussion properly.
Getting Help
Think Filing helps boards set up risk management policies, risk registers and reporting that meet Companies Act expectations.