Risk Assessment Framework Design

It is the structured system your organisation uses to identify what could go wrong (risks), decide how much of that risk you are willing to accept (risk appetite), track and prioritise the risks that matter (a risk register), and assign clear ownership for managing them. It is not a one-time report — it is a recurring process with a governance structure (usually an Audit Committee or Risk Management Committee) that keeps it alive and relevant as the business changes.

It depends on your entity type and regulatory status. There is no blanket statutory requirement for every private company to maintain a COSO- or ISO 31000-aligned framework. However, under Section 134(5)(e) of the Companies Act 2013, the Board's responsibility statement (for listed companies, and in practice a good governance expectation for larger private companies) must confirm that internal financial controls are adequate and operating effectively — a confirmation that is difficult to make credibly without an underlying risk assessment process. For SEBI-listed entities within the top 1,000 by market capitalisation, Regulation 21 of the SEBI (LODR) Regulations, 2015 mandates a Risk Management Committee with a defined charter and reporting cadence.

A risk appetite statement is the Board's explicit articulation of how much risk the organisation is willing to accept, by category (financial, operational, compliance, reputational, strategic, technology), in pursuit of its objectives. Without it, risk scoring in the register becomes subjective and inconsistent — one manager's 'high risk' is another's 'medium.' The risk appetite statement gives the scoring methodology an anchor and gives the Board a documented, defensible basis for its risk tolerance decisions.

Both are internationally recognised and neither is mandated by Indian law for most private companies. COSO's Enterprise Risk Management Integrated Framework is more comprehensive and strategy-linked — commonly chosen by organisations preparing for institutional investment, listing readiness, or complex multi-entity risk exposure, and it aligns naturally with the internal financial controls documentation many boards must already maintain. ISO 31000:2018 is a leaner, principles-based international standard, more proportionate for mid-sized private companies that want rigour without over-engineering. In practice, most PNPC engagements borrow structural elements from both, calibrated to the organisation's size and regulatory context, rather than adopting either framework in its complete textbook form.

Under Regulation 21 of the SEBI (LODR) Regulations, 2015, a Risk Management Committee is mandatory for the top 1,000 listed entities determined on the basis of market capitalisation, as well as certain other categories of listed entities specified by SEBI from time to time. The RMC must have a defined composition (a majority of members being Board directors, including at least one independent director for applicable categories), a documented charter, and must meet at a prescribed minimum frequency, reporting to the Board on the risk management framework's effectiveness. Companies outside this mandated scope are not statutorily required to constitute a separate RMC, though many voluntarily route risk oversight through the Audit Committee.

Internal financial controls are the specific policies and procedures that ensure the orderly and efficient conduct of business, accuracy and completeness of accounting records, and timely preparation of reliable financial information. A risk assessment framework is broader — it covers financial, operational, compliance, reputational, and strategic risk — but the two are deeply linked: you cannot credibly assess whether your internal financial controls are 'adequate and operating effectively' (the Board's Section 134(5)(e) confirmation) without first identifying the financial risks those controls are meant to address. PNPC designs the risk framework to explicitly interface with, and support, the IFC documentation and testing that underpins this Board confirmation.

There is no statutory mandate specific to private unlisted companies to build a formal risk framework. Whether you need one is a business judgement, not a compliance requirement. Common triggers we see for unlisted private companies: preparing for institutional fundraising where investors expect governance readiness, a recent adverse event (fraud, major vendor failure, cybersecurity breach) that exposed the lack of a structured process, growth past the point where risk can be tracked informally by the founder or CEO, or a lender covenant or large enterprise customer contract that expects evidence of risk governance.

For a mid-sized organisation, a realistic timeline from initial scoping to Board approval is 8 to 10 weeks — covering scoping, risk identification workshops across functions, risk appetite statement drafting, scoring methodology design, control mapping, governance charter drafting, and Board presentation. Complex multi-entity or multi-jurisdiction groups (including India-UAE structures) typically take longer given the need to map risk across each entity and regulatory regime. A lighter-touch framework for an early growth-stage company can be built faster, in proportion to its complexity.

At its core, yes — a risk register is typically a structured spreadsheet or dashboard listing each identified risk, its category, likelihood score, impact score, overall risk rating, existing controls, control gaps, the named risk owner, planned mitigation actions, target dates, and current status. What separates a working register from a shelf document is not the tool (spreadsheet versus dedicated GRC software) but the discipline of updating it on a defined cadence and using it to drive actual management decisions and board reporting.

Scoring inevitably involves judgement, but a good framework reduces subjectivity by defining concrete, organisation-specific criteria for each score level before any risk is scored. For example, 'high impact' on a financial risk might be explicitly defined as 'potential loss exceeding X% of annual revenue or Y absolute rupee value' rather than left to individual interpretation. PNPC calibrates these thresholds to your organisation's actual financial scale during the framework design phase, and scoring is typically done collaboratively across function heads with a facilitator (PNPC, initially) to reduce inconsistency between departments.

The risk register is a periodic (typically quarterly) point-in-time assessment. Key Risk Indicators are ongoing, trackable metrics designed to give an early warning that a specific high-priority risk is trending toward materialising, between formal review cycles. Examples include customer concentration percentage trending upward, days sales outstanding lengthening, employee attrition in key roles rising, or the frequency of near-miss cybersecurity incidents increasing. PNPC designs KRIs only for the highest-priority risks in the register — tracking too many KRIs dilutes attention and becomes unsustainable.

There should be a single named internal coordinator — most commonly the CFO, Company Secretary, or a designated Chief Risk Officer / risk manager in larger organisations — responsible for maintaining the register, coordinating the periodic review cycle, and preparing the Board or Audit Committee/RMC reporting pack. Individual risks within the register are owned by the relevant function head, but the overall framework needs one accountable coordinator or it drifts.

A common and reasonable cadence is quarterly review at the management level, with reporting to the Audit Committee or Risk Management Committee at a frequency consistent with your committee's meeting schedule — and for SEBI-listed entities within Regulation 21 scope, in line with the minimum frequency prescribed for RMC meetings. New risks (from a new business line, regulatory change, or major contract) should be added to the register as they emerge rather than waiting for the next scheduled quarterly cycle, and material risk events should trigger an immediate ad-hoc review.

A risk framework cannot guarantee prevention of every adverse event — its purpose is to systematically increase the likelihood that material risks are identified, monitored, and mitigated before they materialise, and to provide a structured process for learning from events that do occur. If a fraud incident has already happened, the immediate priority is root-cause analysis: was this risk category identified in any prior assessment? Was there a control gap that should have been flagged? PNPC treats a material risk event as a direct input into refreshing the framework and control environment — not a separate, one-off forensic exercise disconnected from ongoing risk management.

PNPC's risk advisory practice focuses on framework design, risk assessment, internal controls advisory, and governance structuring. Where a material event requires forensic investigation, quantification of loss, or litigation support, we scope that as a related but distinct engagement — often working alongside the risk framework refresh so that findings from the investigation directly inform the updated risk register and control recommendations.

Your statutory auditor independently performs a risk-based audit under Standards on Auditing, which includes their own assessment of risks of material misstatement in the financial statements — this is a distinct, auditor-owned process governed by auditing standards, not something PNPC's risk advisory engagement replaces or performs on the auditor's behalf. However, a well-documented enterprise risk framework — particularly the sections addressing financial and compliance risk and the internal control environment — is a valuable input the auditor will typically review, and it supports the Board's own Section 134(5)(e) internal financial controls confirmation, which is separate from the auditor's own risk assessment.

Risk management (the framework PNPC builds) is a forward-looking, management- and Board-owned process for identifying and responding to risks before they materialise. Internal audit is typically an independent assurance function — either an in-house team or an outsourced provider — that periodically tests whether the controls management has put in place (including those addressing risks in the register) are actually operating as designed. The two are complementary: the risk register often forms the basis for the internal audit plan, prioritising audit focus on the highest-risk areas, while internal audit findings feed back into refreshing the risk register.

Yes — PNPC's risk advisory engagements for India-UAE groups build a consolidated framework that captures entity-specific and group-level risks, including cross-border risk categories: FEMA and RBI compliance risk on the India side, UAE Corporate Tax and regulatory compliance risk on the UAE side, transfer pricing exposure on intercompany transactions, and consolidated financial reporting risk where applicable. With operating offices in Chennai, Bangalore, Hyderabad, and Dubai, PNPC coordinates the framework build across both jurisdictions under a single engagement rather than requiring you to brief separate advisors in each country.

PNPC charges a fixed, agreed professional fee for a risk framework engagement, scoped after the initial conversation based on your organisation's size, number of business functions and entities involved, regulatory complexity (including any SEBI LODR RMC requirements), and whether workshops are needed across multiple locations or jurisdictions. The exact fee and scope are confirmed in writing before work begins — there is no standard 'off-the-shelf' price because the effort genuinely varies with organisational complexity.

Many risk framework engagements are delivered competently by dedicated GRC (Governance, Risk, Compliance) consultants or boutique risk advisory firms, and there is no legal requirement that this work be performed by a Chartered Accountant. The advantage of engaging a practising CA firm like PNPC is the direct interface with statutory compliance obligations that a pure GRC consultant may not have day-to-day familiarity with — Section 134(5)(e) internal financial controls, the statutory audit process, tax and regulatory risk specifics, and (for our clients) an existing understanding of your financial statements, compliance history, and business from other engagements.

Institutional investors' legal and financial due diligence processes routinely probe governance maturity — whether the Board has visibility into key risks, whether internal controls are documented and tested, and whether there is a structured process (rather than founder intuition alone) managing operational, financial, compliance, and reputational risk. A well-documented risk framework, with evidence of Board or Audit Committee engagement (minutes, review cycles), materially strengthens the governance narrative in diligence and can pre-empt additional warranty, indemnity, or valuation-discount asks that arise when investors perceive governance as immature.

For most private, unlisted companies, there is no requirement to file the risk framework itself with any regulator — it is an internal governance document, though the Board's confirmation on internal financial controls under Section 134(5)(e) is disclosed in the Board's report attached to the annual financial statements. For SEBI-listed entities, certain risk-related disclosures are required in the annual report and, where applicable, the Business Responsibility and Sustainability Report (BRSR) — though the full risk register and appetite statement themselves remain internal documents; only summarised risk disclosures are made public.

Inherent risk is the level of risk that exists before considering any mitigating controls — the raw exposure. Residual risk is the level of risk that remains after accounting for the controls and mitigation measures currently in place. A risk register that only scores inherent risk overstates the organisation's actual exposure and does not show where controls are working; a register that only scores residual risk can understate how serious a risk would be if a control failed. PNPC's framework scores both, so the Board can see the effectiveness of existing controls (the gap between inherent and residual) as well as the current actual exposure.

The governance structure PNPC designs typically includes a defined escalation protocol for risks that emerge or materially change between scheduled Board or Audit Committee meetings — usually a threshold-based trigger (a risk scored above a certain severity, or any risk event with actual or potential financial/reputational impact above an agreed threshold) that requires immediate escalation to the Committee Chair or Board Chair outside the regular cycle, rather than waiting for the next scheduled meeting.

Yes — cybersecurity and technology risk is typically one of the standard risk categories within the framework (alongside strategic, operational, financial, compliance, and reputational risk), and is increasingly one of the highest-scored categories across most organisations given the rising frequency of cyber incidents. PNPC's framework identifies and scores cybersecurity and data protection risks at an enterprise-governance level — data breach exposure, third-party/vendor access risk, business continuity risk from a system outage — but for deep technical cybersecurity control implementation (network security architecture, penetration testing, technical remediation), we recommend a specialist technical security partner working alongside the risk framework, with PNPC ensuring the governance and Board-reporting layer stays connected to their technical findings.

No, though they are related and, in smaller organisations, functions sometimes overlap. The Audit Committee, mandated under Section 177 of the Companies Act 2013 for specified classes of companies, has a statutorily defined mandate centred on financial reporting oversight, auditor recommendation and oversight, and related-party transaction approval. A Risk Management Committee, where mandated under SEBI (LODR) Regulation 21 or voluntarily constituted, has a broader mandate specifically focused on enterprise risk oversight across all risk categories, not solely financial reporting risk. Where a company is not required to have (or chooses not to constitute) a separate RMC, risk oversight responsibility is commonly routed through the existing Audit Committee.

This is the most common way risk frameworks fail — not at the design stage, but at the sustained-use stage. A framework that is built, presented once, and then never revisited provides false assurance: on paper, governance looks mature; in practice, the Board has no current visibility into the organisation's actual risk exposure. This creates real exposure if a material risk event occurs and any subsequent inquiry (by an auditor, regulator, or in litigation) reveals the framework was not being used as represented.

We offer both models depending on client need: a one-time framework build with handover and training for organisations that want to run the framework independently going forward, and an ongoing advisory retainer for organisations that want PNPC to facilitate the quarterly review cycles, refresh the register, and prepare Board/RMC reporting packs on a continuing basis. Many clients start with the former and move to the latter once they experience how much discipline the review cadence actually requires.

Risk framework design sits within PNPC's Governance, Risk & Compliance (GRC) practice under our broader Risk Advisory pillar, which also covers internal audit, internal financial controls testing, fraud risk assessment, and regulatory compliance advisory. For clients where PNPC also serves as statutory auditor, tax advisor, or compliance retainer client, the risk framework engagement benefits from — but is delivered independently of, where auditor-independence rules require it — the institutional knowledge PNPC already holds about the business.

A generic risk consulting firm can deliver a technically sound framework but typically lacks the day-to-day statutory compliance context — how the framework interfaces with Section 134(5)(e) internal financial controls certification, the statutory audit process, or India-UAE cross-border regulatory risk. Building in-house without external facilitation is possible but commonly stalls at the risk appetite statement stage (a genuinely difficult document to draft objectively from inside the organisation) and rarely sustains the review cadence without external accountability. PNPC combines CA-level regulatory and financial fluency with dedicated risk framework methodology, and — because we are a practising firm present since 1986 across India and the UAE — we remain available for the ongoing review cycles, not just the initial build.