The Risk Management Committee

Risk Management Committee explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.

The newest of the mandatory committees, and the one whose remit has expanded fastest. When SEBI first required it, "risk" mostly meant credit, currency and commodity exposure. Today the regulation names cyber security explicitly and Schedule II names ESG — two categories that didn't feature on most Indian board agendas five years ago.

For an independent director, this is the committee where the questions are hardest to fake.

Applies to the top 1,000 listed entities by market capitalisation. Minimum three members, a majority of them board members, including at least one independent director; the chairperson must be a board member, and senior executives may be members. Meets at least twice a year, with no more than 180 days between meetings. Quorum: two members or one-third, whichever is higher, including at least one board member. Its policy must cover financial, operational, sectoral, sustainability/ESG, information and cyber security risks, and be reviewed at least once every two years.

Who must have one

Regulation 21 applies to the top 1,000 listed entities, determined by market capitalisation as at the end of the immediately preceding financial year. It also applies to a listed entity with outstanding superior voting rights (SR) equity shares.

The category is recomputed annually. An entity that enters the top 1,000 has to constitute the committee; one that leaves it doesn't automatically dissolve it, and most don't.

The Companies Act has no equivalent committee requirement. What it does have is Section 134(3)(n), requiring the Board's report to include a statement on the development and implementation of a risk management policy, identifying elements of risk that may threaten the company's existence. So an unlisted company still needs a policy — it just doesn't need a committee to own it.

Composition and meetings

The composition is deliberately hybrid. Unlike the audit committee and the NRC — which are director-only bodies — the RMC is designed to put executives who actually run risk systems in the same room as directors who oversee them. A risk committee without the chief information security officer present is discussing cyber risk secondhand.

The 180-day rule is the constraint that matters operationally. Two meetings a year satisfies the count, but if you hold them in April and December you've breached the gap. Space them.

What the policy must cover

Schedule II requires the committee to formulate a detailed risk management policy covering:

• a framework for identifying internal and external risks, specifically including financial, operational, sectoral, sustainability (particularly ESG-related), information and cyber security risks;
• measures for risk mitigation, including systems and processes for internal control; and
• a business continuity plan.

Beyond the policy, the committee must:

• ensure appropriate methodology, processes and systems are in place to monitor and evaluate risks;
• monitor and oversee implementation of the policy, including evaluating the adequacy of risk management systems;
• review the policy periodically — at least once every two years — taking into account changing industry dynamics and evolving complexity;
• keep the board informed about the nature and content of its discussions, recommendations and actions.

And one governance safeguard worth knowing: the appointment, removal and terms of remuneration of the Chief Risk Officer, where the entity has one, are subject to review by the RMC. That's the same structural protection the audit committee gives the internal auditor — the person whose job is to find problems shouldn't be employed entirely at the discretion of the people whose problems they find.

RMC or audit committee?

The remits overlap and boards handle the boundary badly.

The audit committee evaluates internal financial controls and risk management systems under Section 177(4). Its lens is assurance: are the controls designed and operating effectively, and does the financial reporting reflect reality?

The RMC owns the risk framework itself. Its lens is forward-looking: what could damage this business, how likely is it, what are we doing about it, and can we keep operating if it happens?

A workable split: the RMC decides what the risks are and what we're doing; the audit committee tests whether the controls we claim to have actually work. Where the same independent director sits on both — common, and sensible — they should be conscious of which hat they're wearing, because the questions are genuinely different.

Questions worth asking

• When did the risk register last change materially? A register that looks the same year after year isn't being used.
• What are the top five risks, and who owns each one by name?
• What's our cyber incident history — including the ones that didn't become public?
• When was the business continuity plan last tested, not just written?
• What ESG risks are financially material to us, as opposed to reputationally interesting?
• Does the CRO have a reporting line that doesn't run entirely through the CEO?
• What did we decide to accept rather than mitigate, and why?

The last one is the most revealing. Every risk framework involves accepted risk. A committee that has never explicitly accepted a risk isn't making decisions — it's receiving presentations.

Key takeaways

• Top 1,000 listed entities by market capitalisation, recomputed annually.
• Three members minimum, board majority, at least one independent director, board-member chairperson.
• Senior executives may be members — the design intends it.
• Twice a year, and no more than 180 days apart.
• Policy must cover financial, operational, sectoral, ESG, information and cyber security risks, plus business continuity.
• Policy reviewed at least once every two years.
• The CRO's appointment, removal and remuneration are subject to RMC review.
• Unlisted companies still need a risk management policy under Section 134(3)(n) — just not a committee.

Read next

• Audit Committee: Composition, Powers and the Independent Director's Role
• SEBI LODR Corporate Governance Requirements for Listed Companies
• Duties of an Independent Director: Schedule IV Explained
• CSR Committee Under Section 135 and the Independent Director

Law stated as on 5 September 2026. Market-capitalisation categories are recomputed each year — confirm your entity's current position before assuming the regulation does or doesn't apply.