Managing Risks Effectively

Risks are inevitable to every business. We have in place a robust risk management mechanism and governance to effectively mitigate risks and create opportunities which is essential to achieving our strategic goals and sustainable development. We remain committed to continually improving our risk management system.

Risk Management Framework and approach

Our Risk Management Framework and Governance encompasses oversight by the Risk Management Committee consisting of our Board Members. Our primary goal is to establish and implement an Integrated Risk Management Framework that enables appropriate risk reporting and mitigation and to take informed decisions regarding emerging risks. In FY22, we engaged KPMG to augment our risk management framework by identifying gaps, assisting in preparing comprehensive documentation, risk reporting and training of staff in line leading industry practices. Their analysis indicates that we have most of the critical elements in place. They have suggested certain improvement areas like enhanced monitoring of key risk indicators (KRIs), enhanced risk accountability and improvements in the risk assessment process which are being worked upon.

Strengthening risk management culture

We are focused on process improvement, implementing robust system capabilities and enhancing the business and process acumen across our employee-base. The risk management team has grown stronger and has augmented the capability to identify, assess, monitor and manage risks with clear responsibility and accountability for risk decisions and the overall decision-making process.

We have also worked towards strengthening risk management at managerial levels. Operations risk management workshops were conducted for the employees to enhance the culture of risk mitigation. Regulatory training programs to update on the recent changes were conducted and regulatory certification has been mandated for all managers.

Business Continuity Plan (BCP)

Our best-in-class BCP framework is designed to ensure continuity of core MF processes. It ensures ready connectivity of the entire MF ecosystem (comprising all AMCs and their entire value chain and our front and middle offices) to BCP site with our reinforced technology infrastructure. We continue to test its efficacy as well as the readiness of people and other associated arrangements through conducting regular BCP drills.

Key risk areas and mitigation measures

Cyber Security Risk

Given most of our operations is digital and involves working around with huge volume of customer information, it is critical for us to protect data from cybersecurity breach and also ensure data privacy.

Operational Risk

The Company faces risks in its operations for any error or omission that could lead to significant monetary and reputational losses. The Company has identified the key areas where such risks could exist and taken proactive steps for carrying out process automation and tighter adherence to the established processes.

Regulatory Risk

The Company is a Qualified Registrar and Transfer Agent (“QRTA”) and is subjected to audits from the Regulator. Non-compliance of any regulations could result in observations in the Audits and can expose the Company to warnings and penalties. This can also result in possible fines. To reduce the audit observation, there exist a process of identification of outliers on real-time basis for the known observation primarily, which are getting remediated on immediate basis. This process is automated with workflow enabled model, such that Audit Observations on critical areas would be avoided.

Compliance Risk

The Company is required to comply with a host of regulations as part of its compliance activities. Any default could result in fines and penalties. For addressing the same, the Company has an extensive system for monitoring compliances with individual functional heads tasked with specific areas.

Extensive support from external experts has been taken for all areas and these experts have been retained on a regular basis. Multiple audits are carried out for ensuring these compliances and are reported to the Audit Committee/Board at its Meetings. Audit/other related mitigating avenues have been identified and implemented.

Mitigation measure: We have a robust cybersecurity policy governed by technology committee. Regular internal and external (by specialist firms) audits are undertaken to ensure high standards.