Strategic Risk Management explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
"Risks come unexpectedly and do not wait for annual assessments." Nor does a strong risk culture mean refusing to take any.
The reframing
My favourite view is on Enterprise Risk Management which I like to refer to as Strategic Risk Management. Please do not feel assured that this is an annual exercise because risks come unexpectedly and do not wait for annual assessments. Further, inherently business enterprise will take calculated risks and reap rewards so a strong risk culture does not mean risk-averse culture!
The first is about frequency. Enterprise risk management is commonly run as an annual cycle — a register is compiled, ratings are assigned, mitigations are recorded, and the document is presented once a year.
The objection is simple and hard to answer: risks come unexpectedly and do not wait for annual assessments. An annual register describes the risks that were visible when it was written. The risk that damages a company is usually the one that emerged since.
Which is why the same practitioner recommends a monthly call with the CFO or the CEO or both and describes the role as 24 by 7 by 52. Risk oversight is continuous or it is retrospective.
The second correction is about direction. A strong risk culture does not mean risk-averse culture.
This matters because directors who take risk seriously can drift into obstruction, and a board that blocks everything destroys value as surely as one that approves everything. The purpose of a risk framework is to allow the enterprise to take calculated risks and reap rewards — knowing which risks are being taken, how large they are, and what happens if they crystallise.
Renaming the function Strategic rather than Enterprise risk management captures that. It is not a compliance register maintained alongside the strategy; it is part of how the strategy is set.
The ESG agenda
Responsibility on sustainable growth that protects environment, which thrives on bedrock of governance and is inclusive to share benefits with the society. Boards will have to be extremely sensitive towards this responsibility by blending this objective when deliberating on the strategy for growth.
Note the structure of that definition. Environmental protection and social inclusion are the objectives; governance is described as the bedrock on which both rest. That ordering is deliberate — a company without sound governance cannot deliver credible environmental or social outcomes, whatever it reports.
And the operative instruction is blending this objective when deliberating on the strategy for growth, not reporting on it afterwards.
What has come to the fore
| Area | The board's role |
|---|---|
| People resources | After the pandemic, employee health, stress management, providing infrastructure support and reinforcing employability — all of which may need to be reviewed by the board |
| Succession planning | Ensuring depth of talent is known and developed |
| Crisis management | Ensuring that the company is ready and the business continuity plans and contingency plans are indeed working and continuously reviewed |
| Diversity and inclusion | Not only for gender but also for age and culture — encourage young talent and induct gender and age diversity in the board room |
| Start-up boards | Balancing sustainable growth against the investors' agenda and their entitlement to hefty returns |
The standard applied to it all
The actions and decisions of board members will have to stand the test of scrutiny by touchstone of ethics and fair play.
And the stated purpose of the reflections: my objective and intent in sharing these reflections is not to deter young aspiring professionals to take up board positions but to get them Future Ready for handling the responsibilities that go with that position.
Common mistakes
- Running strategic risk management as an annual register.
- Treating a strong risk culture as a reason to block calculated risks.
- Reporting on ESG rather than blending it into strategy.
- Reviewing business continuity plans only after a crisis.