Enterprise Risk Management (ERM): What It Actually Involves
Most Indian companies discover their real risk exposure the hard way — a key customer concentration that suddenly unravels, a cyber incident that halts operations, a regulatory change that catches the business flat-footed, or a related-party transaction that draws board and auditor scrutiny at the worst possible moment. Enterprise Risk Management (ERM) is the discipline that surfaces these exposures before they become crises — and gives the Board, the Audit Committee, and management a shared, structured view of what could go wrong, how likely it is, and what the organisation is doing about it. At PNPC Global, we design and implement ERM frameworks aligned to ISO 31000:2018 and the COSO ERM Integrated Framework (2017), calibrated to your sector, your governance maturity, and — where applicable — the Listing Obligations and Disclosure Requirements (LODR) Regulations that make Risk Management Committee oversight mandatory for the top 1,000 listed companies by market capitalisation.
What This Actually Covers
Enterprise Risk Management is a structured, organisation-wide discipline for identifying, assessing, treating, monitoring, and reporting the risks that could affect an entity's ability to achieve its objectives — spanning strategic, operational, financial, compliance, reputational, and technology risk categories. Unlike traditional risk management, which historically operated in silos (insurance risk sat with finance, IT risk sat with IT, compliance risk sat with legal), ERM takes an integrated, enterprise-wide view — recognising that risks interact, correlate, and can compound across functions. The two globally recognised reference frameworks are ISO 31000:2018, which provides principles and generic guidelines applicable to any organisation regardless of size or sector, and the COSO ERM Integrated Framework (2017), titled 'Enterprise Risk Management — Integrating with Strategy and Performance', which explicitly links risk management to strategy-setting and performance measurement.
For the full scope, current process and what PNPC includes, see the dedicated Enterprise Risk Management (ERM) service page.
When You'd Need This
- Listed company falling within the top 1,000 by market capitalisation — a Board-level Risk Management Committee and a documented risk management policy are mandatory under Regulation 21 of SEBI LODR
- Private equity or venture capital investors on the cap table, or an active fundraising process — institutional investors increasingly expect a documented risk register and risk governance structure as part of due diligence and ongoing reporting covenants
- Rapid growth, new geography entry, or a new product line that has outpaced the organisation's informal, ad hoc approach to identifying and managing risk
- Recent exposure to a risk event — cyber incident, key-customer loss, regulatory penalty, fraud, or supply-chain disruption — that has prompted the Board to ask 'what else haven't we identified?'
What This Doesn't Cover
- Very early-stage startup with a handful of employees, no institutional investors, and a founder who can personally track the handful of risks that matter — a structured ERM programme is premature; a simple founder-level risk list often suffices for now
- Small private company well below all statutory thresholds, with straightforward single-location operations and no near-term fundraising or listing plans — a lighter risk discussion as part of annual strategic planning may be adequate
- Organisation needs help with a single, narrow risk domain — for example, only IT/cybersecurity risk, or only fraud risk — where a scoped assessment in that domain is more efficient than standing up a full enterprise-wide framework
Questions We're Actually Asked
What exactly is Enterprise Risk Management, in plain terms?
It is a structured way for an organisation to answer three questions on an ongoing basis: what could go wrong across the business (not just in finance, but strategy, operations, compliance, technology, and reputation), how likely and how damaging is each of those risks, and what is the organisation actually doing about the ones that matter most. Instead of each department worrying about its own risks in isolation, ERM gives the Board and management one integrated view — typically captured in a risk register and reported through a Risk Management Committee.
Is Enterprise Risk Management mandatory for my company?
A Board-level Risk Management Committee and a documented risk management policy are mandatory under Regulation 21 of the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015, for the top 1,000 listed companies by market capitalisation. Separately, Section 134(3)(n) of the Companies Act 2013 requires every listed company's Board's Report to include a statement on the development and implementation of a risk management policy. Companies outside these thresholds are not statutorily required to run a formal ERM programme, but increasingly face expectations from investors, lenders, rating agencies, and — for regulated sectors like NBFCs, banks, and insurers — sector regulators.
What is the difference between ISO 31000 and the COSO ERM framework — do I need to pick one?
Both are internationally recognised, principles-based reference frameworks rather than rigid checklists. ISO 31000:2018 is a generic risk management standard applicable to any organisation, structured around principles, a framework, and a process (identify, analyse, evaluate, treat, monitor). COSO ERM (2017) is more explicitly linked to strategy and performance, and is widely used by companies with US-linked governance expectations or those benchmarking against COSO's earlier Internal Control Integrated Framework used for IFC purposes. Neither is mandated by Indian law by name — SEBI and the Companies Act require the outcome (a documented, Board-approved risk management policy and process) without prescribing a specific named framework.
Where PNPC Fits In
A risk register that sits in a folder protects no one. Talk to PNPC Global about building an Enterprise Risk Management framework your Board will actually use.
PNPC Global has advised Chennai, Bangalore and Hyderabad businesses since 1986. Explore the full Risk Advisory practice for related services, or go straight to the Enterprise Risk Management (ERM) page for specifics.
Rates, thresholds and filing dates are set by the relevant authority and revised periodically. Treat anything numeric here as "ask PNPC for the current figure," not as a quoted fact.