Governance, Risk & Control Assurance

It is an independent check on three things together: whether your Board and committees are structured and functioning the way governance rules expect (Governance); whether your organisation has properly identified and is actively managing its most important risks (Risk); and whether the day-to-day controls that are supposed to prevent errors, fraud, and non-compliance actually work in practice, not just on paper (Control/Compliance). Most reviews look at only one of these in isolation. GRC Assurance looks at all three together, because in practice they interlock — a governance gap often explains why a risk went unmanaged, which in turn explains why a control failed.

There is no single statute in India titled 'GRC Assurance' that mandates the exact engagement by that name. However, several underlying obligations make it highly relevant: SEBI LODR Regulation 21 requires the top 1,000 listed companies by market capitalisation to have a functioning Risk Management Committee; Section 134(5)(e) of the Companies Act 2013 requires directors of applicable companies to state that internal financial controls are adequate and operating effectively; and Section 177(9) requires a Vigil Mechanism. GRC Assurance is the independent activity that gives the Board a defensible basis for making those statements and meeting those obligations in substance.

Internal Audit (mandatory under Section 138 for listed companies and prescribed classes under Rule 13) is typically a recurring, process-focused testing function that works through a risk-based annual audit plan, function by function — procurement this quarter, payroll next quarter, and so on. GRC Assurance takes a step back and looks at the governance and risk architecture as a whole — is the Board structured correctly, is there a real risk register that risk owners use, does the compliance tracking system actually work — before or alongside testing individual process controls. In a mature organisation, GRC Assurance often sets the risk-based plan that the Internal Audit function then executes against.

The statutory audit under the Companies Act gives shareholders an opinion on whether your financial statements present a true and fair view — its scope is the financial statements and the controls that materially affect them. GRC Assurance is broader and forward-looking: it covers the Board's governance structure, the enterprise-wide risk framework, and controls across operational, compliance, and IT domains that may never surface in a financial statement audit at all — such as whether your whistleblower mechanism actually works, or whether your Delegation of Authority matrix reflects reality.

An IFC Review is a specific, codified engagement — typically performed by or relied upon by the statutory auditor under Section 143(3)(i) — testing the design and operating effectiveness of controls specifically over financial reporting, following the ICAI's Guidance Note on Audit of Internal Financial Controls. GRC Assurance is broader: it covers governance structures and enterprise-wide risk management in addition to controls, and the controls it tests are not limited to those affecting financial reporting — operational, compliance, and IT controls are all in scope. In practice, IFC work is often one input into, or run alongside, a fuller GRC Assurance programme.

SEBI LODR obligations apply only to listed companies, so the specific Risk Management Committee mandate does not apply to you. But GRC Assurance remains highly relevant for unlisted companies in three common scenarios: preparing for institutional fundraising, where investor due diligence will assess governance maturity regardless of listing status; family businesses professionalising ahead of succession or bringing in external directors; and any company where rapid growth has outpaced the formality of its governance and control structures.

We reference the COSO Enterprise Risk Management framework (COSO ERM 2017) for risk management assessment and the COSO Internal Control – Integrated Framework (2013) for control environment assessment — both widely recognised internationally and referenced in Indian regulatory guidance. Where relevant, we also draw on ISO 31000 for risk management principles. We do not force a rigid framework onto every client; we calibrate the depth and formality of the assessment to your size, sector, and regulatory profile.

A first-time, entity-wide review for a mid-sized company typically takes 8–10 weeks from initial scoping to the final Board presentation, depending on the number of locations, subsidiaries, and process areas covered. Subsequent annual or periodic reviews are generally faster once the risk register, control matrix, and prior findings baseline already exist. A narrowly scoped review — for example, focused only on governance structure and risk register maturity without full operating-effectiveness testing — can be completed faster.

Fees depend on entity size, number of locations and subsidiaries, the process areas in scope, and whether the engagement includes operating-effectiveness testing (sample transaction testing) or is limited to a design-level governance and risk review. PNPC provides a written scope and fixed-fee proposal after an initial scoping conversation — we do not quote a fee without first understanding what triggered the need and how deep the review needs to go.

Independence matters here. Where PNPC is also your statutory auditor, we structure the GRC Assurance engagement with an appropriately separate team and reporting line to preserve independence and avoid the auditor effectively reviewing its own work. For companies where independence rules under the Companies Act or SEBI regulations restrict the statutory auditor from providing certain non-audit services, we advise upfront on whether PNPC can undertake the GRC engagement or whether it should be performed by an independent firm.

A risk register is a structured document listing an organisation's identified risks, their likelihood and potential impact, the mitigation measures in place, and the person accountable for each risk. Many companies have a risk register that was created once — often for an audit or a funding round — and never updated again. Testing whether it is 'actually used' means checking whether risk owners can describe their assigned risks without reading from the document, whether the register has been updated for new risks in the last review cycle, and whether Board or Committee minutes show genuine discussion of it rather than a formality.

The Vigil Mechanism is a formal channel required under Section 177(9) of the Companies Act 2013 for listed companies and certain classes of prescribed companies (those accepting deposits from the public, or having borrowed money from banks/public financial institutions exceeding ₹50 crore), and separately under SEBI LODR Regulation 22 for listed companies, allowing directors and employees to report genuine concerns about unethical behaviour, fraud, or violation of the company's code of conduct, with protection against victimisation. As part of GRC Assurance, we test whether the mechanism exists on paper, whether employees are actually aware of it, and how any complaints received were investigated and closed.

A DoA matrix defines who in the organisation has authority to approve what — transaction types, spending limits, hiring decisions, contract sign-off — at each level of the hierarchy. It is one of the most fundamental internal controls because it prevents any single individual from having unchecked authority over material decisions. In our GRC reviews, we frequently find a documented DoA that has not been updated as the organisation has grown or restructured, or that is routinely bypassed in practice — both of which materially increase fraud and error risk.

GRC Assurance includes a review of IT general controls (ITGC) — access management, change management, backup and business continuity — as part of the broader control environment assessment, because IT controls underpin the reliability of financial and operational data across the business. However, a deep technical cybersecurity assessment (penetration testing, vulnerability scanning, technical security architecture review) is a more specialised, separate engagement. We scope which level of IT coverage is appropriate for your GRC review and can bring in or refer to our dedicated cybersecurity audit capability where a deeper technical review is warranted.

If the immediate need is to investigate a specific incident — establish what happened, who was involved, and quantify any loss — that is a Forensic Audit, a narrower and more urgent engagement. GRC Assurance is the broader, subsequent (or parallel) exercise that asks the systemic question: what governance or control gap allowed this to happen, and where else might similar gaps exist? Many clients commission both — a forensic audit to resolve the specific incident, and a GRC Assurance review to address the root cause and prevent recurrence elsewhere in the organisation.

Institutional investors and IPO due diligence teams routinely assess Board composition and independence, the risk management framework, related party transaction governance, and internal control maturity as part of their process — and gaps found late in a live transaction can delay timelines or affect valuation and deal terms. A GRC Assurance review conducted proactively, well before the transaction process begins, identifies and allows remediation of these gaps on your own timeline rather than under the pressure and scrutiny of active diligence.

No. A GRC Assurance engagement is a private, management-and-Board-facing advisory and assurance exercise — findings are reported to the Audit Committee, Risk Management Committee, or Board that commissioned the review, not to SEBI, MCA, or any other regulator. The purpose is to give the Board the information and time to remediate proactively. Separately, where a finding indicates a potential fraud that triggers a statutory reporting obligation under Section 143(12) of the Companies Act, that obligation falls specifically on the statutory auditor in that defined circumstance — not on a GRC Assurance provider conducting an advisory review.

Yes. While entity-wide GRC Assurance gives the most complete picture, we regularly scope focused reviews — for example, governance structure and Board effectiveness only, or risk management framework maturity only, or a control review limited to financial reporting and IT processes. A focused scope is often the right starting point for a company running its first GRC-style review, with broader coverage added in subsequent cycles.

For group structures, we assess whether risk oversight and control standards are being applied consistently across the parent and its subsidiaries — not just at the holding company level — and whether the parent Board has visibility into subsidiary-level risks, including those of any UAE or overseas entity. PNPC's presence in both India and the UAE (Dubai office) allows us to assess governance and control consistency across both jurisdictions under a single coordinated engagement, rather than requiring separate reviews by unconnected local firms that do not share findings.

A management response is management's factual confirmation of each finding, along with their proposed remediation action, owner, and timeline — captured before the report goes to the Audit Committee or Board. This ensures the Board is not seeing findings for the first time without any indication of how management intends to address them, and it gives management a fair opportunity to correct any factual misunderstanding before the report is finalised.

We rate each finding — typically Critical, High, Medium, or Low — based on the likelihood of the underlying risk materialising and the potential impact if it does, combined with how pervasive the control gap is across the organisation. Critical and High findings are those that could result in material financial loss, regulatory non-compliance with meaningful penalty exposure, or reputational damage, and these are highlighted for priority remediation with the shortest recommended timelines.

Both, by design. The report includes practical, sequenced remediation recommendations for each finding — not just a description of the gap. Where the client wants implementation support (redesigning a process, drafting an updated policy, configuring an approval workflow in the ERP), PNPC can support that as a follow-on engagement, kept appropriately separate from the assurance role where independence considerations require it.

For listed companies and larger private companies with an active Risk Management Committee, an annual cycle — even if narrower in scope than the first full review — keeps the risk register and control assessment current as the business evolves. For smaller unlisted companies without a regulatory trigger, a review every 18–24 months, or ahead of any major milestone (fundraise, new geography, significant headcount growth), is generally sufficient.

Regulation 21 of the SEBI LODR Regulations requires the top 1,000 listed companies by market capitalisation (as determined as of the end of the immediately preceding financial year) to constitute a Risk Management Committee, with a majority of members being members of the Board of Directors, including at least one independent director, and with the chairperson being a member of the Board of Directors. The RMC's role includes formulating a detailed risk management policy, monitoring and reviewing it periodically, and reporting to the Board.

An Audit Committee's statutory mandate under Section 177 focuses primarily on financial statements, the statutory audit process, and related party transactions — it does not, by itself, constitute an independent test of whether the broader risk management framework and control environment are functioning. A GRC Assurance review provides the Audit Committee with the independent evidence base it needs to discharge its own oversight role effectively, rather than relying solely on management's self-reporting.

A written GRC Assurance report covering: an executive summary with an overall governance and risk maturity assessment; detailed findings organised by domain (governance, risk, control, compliance) with root-cause analysis; a prioritised, rated findings register; management's response and proposed remediation plan for each finding; and a recommended follow-up review timeline. This is supplemented by a live presentation to the Audit Committee or Board.

Yes. For an early-stage or smaller company without a near-term listing or major fundraise trigger, we typically recommend a scaled-down governance and risk-readiness conversation rather than the full multi-week programme — focused on the handful of foundational elements (a basic risk register, a simple DoA, a whistleblower channel, core financial controls) that matter most at that stage, without the cost and formality appropriate to a listed company.

Where applicable under Section 135 of the Companies Act 2013 (companies meeting the prescribed net worth, turnover, or net profit thresholds), the CSR Committee's governance — its composition, the CSR policy, and whether CSR spend is tracked, reported, and reconciled correctly — is one of the governance areas we review as part of an entity-wide GRC Assurance engagement, alongside the Audit, Nomination & Remuneration, and Risk Management Committees.

Where relevant data and comparable public disclosures are available (for listed peers, primarily through public annual reports and corporate governance reports), we can provide qualitative, directional benchmarking as context for the Board — noting how your committee structure, disclosure practices, or risk framework compare to sector norms. This is offered as useful context rather than a precise quantitative score, since governance maturity depends heavily on company-specific factors.

A design gap means the control, as documented or intended, would not actually prevent or detect the risk it is meant to address even if performed perfectly — for example, an approval control that does not specify a monetary threshold. An operating effectiveness gap means the control is well-designed on paper but is not being consistently performed in practice — for example, approvals are required above a threshold, but our sample testing found several instances where that approval was skipped. Both are reported separately because the remediation is different: a design gap needs a redesigned control; an operating effectiveness gap needs better enforcement, training, or system automation of an already-adequate design.

We design the engagement to minimise disruption — most of the work involves document review, interviews with process owners (typically 30–60 minutes each), and sample-based testing that does not require operational processes to pause. We schedule interviews around the availability of key personnel and typically coordinate through a single internal point of contact (often the Company Secretary or CFO's office) to manage the information flow efficiently.

A Big 4 firm brings brand recognition and large-team capacity, often at a substantially higher fee and with rotating junior staff on the engagement. A boutique risk consultancy may lack the Chartered Accountancy grounding to connect governance findings back to statutory obligations under the Companies Act, SEBI regulations, and tax law with full technical accuracy. PNPC combines nearly four decades of practising CA experience — including the statutory audit, tax, and FEMA/regulatory context that governance findings inevitably touch — with a senior-partner-led engagement model and a presence in both India and the UAE for group structures spanning both jurisdictions.

Scoping consultation to align objectives and right-size the review; governance structure review (Board, committees, DoA); risk register and ERM framework assessment; control design walkthroughs across material process areas; sample-based operating effectiveness testing; compliance management system review; whistleblower mechanism and fraud risk assessment; a rated, prioritised findings register with root-cause analysis; management response capture; a written report; a live presentation to the Audit Committee/Board; and a follow-up verification review within the agreed remediation period.

The GRC Assurance report itself is a private document addressed to the Audit Committee/Board and is not, by default, filed with MCA, SEBI, or any regulator, and is not a public document. Separately, the Board's own Section 134(5)(e) representation in the Board's Report (which is a public filing as part of the Annual Report) may be informed by the findings of a GRC or IFC review, but the underlying detailed report itself remains an internal document unless the company chooses to disclose it or a regulator specifically requests it in the course of an inquiry.