Dolly Dhamodiwala CEO, Business Beacon Management Consultants Risk Management and Internal Controls in Family Managed Medium sized Listed Companies Dolly Dhamodiwala CEO, Business Beacon Management Consultants

Risk Management- A Key Focus Area for Directors of All Companies Biggest Challenge for Promoters- Understanding the multiple forms of risks faced by their organization Are companies in India, especially SMEs and Unlisted companies adequately equipped to manage the emerging and newer forms of risks ? The board’s role has become more complex. This is due to Increasingly dynamic global economy, Political uncertainty, Increased Investor Involvement, Funds Constraints, Disruptive Technologies and an active M&A environment. Effective Risk Management is an integral component of Strategy Formation and Company Performance

Types of Risks Risk is defined as the Combination of the Probability of an Event and its Consequence. The Consequence can be Positive or Negative (Institute of Risk Management - IRM,UK). Thus risk is the Effect of Uncertainty on Objectives – Positive, Negative or a Deviation from the Expected Hazard or Pure risks – Operational or Insurable. Control or Uncertainty risks- Associated with Project Management Opportunity or Speculative risks- Capital Market Risks Usually taken to achieve a positive result

Categories of Risks Internal External Financial Risks Liquidity (Inability to meet Liabilities) Cash-Flow Profitability Interest rate fluctuations Exchange rate fluctuations Credit Default/Counterparty Defaults Capital Market Fluctuations Price Fluctuations Strategic Risks R & D M & As Reputational Intellectual Capital Competition Customer changes Industry changes Operational Risks IT Systems & Security Accounting Controls Supply Chain Communications Process Mgt. & Execution Delivery, Business Interruptions/Model Failure Project Cost Overrun/Time Overrun Fraud Regulations & Compliance Legal Actions Unsatisfactory Service Providers Hazard Risks Employees Properties Natural Events Suppliers Environment ( Eco/Pol./Country/Intl.) Contracts & Obligations

Drivers of Risks Source: Based on FIRM Risk Scorecard risk classification system- UK Risk Mgt. Std. IRM & ISO 31000

What is Risk Management Risk Management - A Process which aims at helping organizations understand, evaluate and take action on all their risks with a view to increasing the probability of success and reducing the likelihood of failure – IRM Traditional Risk Management takes care of individual risks but fails to address the inter-relationship between different risks and their impact

What is Enterprise Risk Management (ERM) ERM – A Process effected by an entity’s Board of Directors, Management and other personnel, applied in Strategy setting, and across the enterprise, designed to identify potential events that may affect the entity, manage risk to be within its risk appetite and to provide reasonable assurance regarding the achievement of the entity’s objectives. Simply put, ERM constitutes ‘All the processes involved in identifying, assessing and judging risks, assigning ownership, taking actions to mitigate or anticipate them and monitoring and reviewing the progress’.

Benefits of ERM Improvement in Operational Performance – Effective Achievement of Core Business Objectives Better Financial Performance – Improvement in Key Financial Performance Indicators, Greater Stakeholder and Investor Confidence, Better Credit Rating and Company Valuation and Reduction in Insurance Costs. Effective Use of Resources and Better Management of Capital and Investments Increased Consistency and Communication of Risks within the company – Standard Conceptual Framework Improved Focus and Perspective to Risk Data for better quantification of risk factors and tolerances

Benefits of ERM Information based Decisions – Strategic Decisions based more on Informed Judgment supported by Enterprise wide Data and Risk factors and Company’s Risk Appetite. Selection of best possible responses to various risks and reduction of losses Better management of multiple and cross-enterprise risks which are generally inter-related. Better management of Competitive Markets and Dynamic Economic Trends Use of key risk metrics and measurement of risks improves the value of reporting and analysis Assurance of Appropriate Internal Controls and Reduction in Cost of Audit

Five Major ERM Processes Risk Identification – Action in Advance. All Potential risks, Positive and Negative Identified Assessing the Impact – Promotes a Risk Awareness Culture and a sense of Accountability Risk Analysis and Evaluation – Assessment of Significance, Probability of Occurrence and Impact. Helps in Assignment of Ownership, Strategy Formulation and Internal Controls Risk Treatment – Alleviating the shocks of Negative Risks and Taking Advantage of Positive Risks. Leads to better Operational Efficiency and Higher Profitability Risk Monitoring & Review. – Helps in framing an effective Business Strategy

Risk Treatment – Responses to Risks The Four T’s for Responding to Risks are: Risk Tolerance – When no action can be taken the Risk has to be Tolerated Risk Treatment – Action taken to Contain the Risk to an Acceptable Level while continuing with the activity Risk Transfer – Conventional Insurance or Third Party assuming the Risk Risk Termination – Avoidance of Activities inducing the Risks when none of the above three are possible

Controls for Risks Risk controls are prescribed based on the Impact and Probability of Each risk Directive Controls – Directions given to Executives in advance for High Impact Risks Detective Controls – Aimed at Identifying the events with undesirable outcomes for Low Impact Risks Corrective Controls – For Treatment of Risks to reduce their Impact and reduce Losses Preventive Controls – Aimed at limiting the possibility of Negative Impact for High Impact High Probability risks which need to be terminated Directive – Directions to Executives in advance – Hedging, Low cost Borrowing, Reduction in cost of Production, etc. Detective – Audit Reports, MIS reports, Controls on Accessibility, Reviews by AC, Information flows, Outcomes envisaged, etc. Corrective – HR issues, Supply chain alterations, Market segment alterations, etc Preventive – Negative impact of Reputational risks, natural Calamities, Insurance of Assets, etc.