Companies Act 2013: Embedding risk management in the business rhythm

Transcription

1 Companies Act 2013: Embedding risk management in the business rhythm

2 Gearing up for implementing Sections 134 & 177 Call to action Assess the adequacy and robustness of your risk management policy and systems Align your risk management framework with business objectives and strategy Identify and refresh your risk universe, including existing and emerging risks Evaluate impact and likelihood of risks and integrate quarterly business performance feedback into risk analysis Assess adequacy/develop mitigation plans for risks impacting business performance Use technology to monitor, measure performance and link it to your planning, reviews and decision making process as part of business rhythm Reward and encourage behaviors that drive risk management discipline Enable board and audit committee to independently evaluate robustness of risk management processes and systems Prepare board of directors (BOD) report, detailing elements of risk that can impact business performance Background and Context Enterprise risk management was not mandatory according to the Companies Act However, as per the new law, there are specific requirements that a company needs to comply with. In addition, the board and audit committee have been vested with specific responsibilities in assessing the robustness of risk management policy, process and systems Applicability Every company Key compliance requirements Section 134: The board of directors report must include a statement indicating development and implementation of a risk management policy for the company including identification of elements of risk, if any, which in the opinion of the board may threaten the existence of the company Section 177: The audit committee shall act in accordance with the terms of reference specified in writing by the board, which shall, inter alia, include evaluation of risk management systems Schedule IV: Independent directors should satisfy themselves that systems of risk management are robust and defensible Key considerations Board, independent directors, executive management etc., must assess risks arising from external factors (black swan, economic conditions, regulatory, competitive etc.) while evaluating the robustness of risk management systems Executive management needs to: Embed risk management across all the business units and critical support functions Make risk management everyone s responsibility Link risk management to business performance of the company 2 Companies Act

3 Questions to be considered by CXOs and Directors Strategy Do we have a risk management framework, which is aligned to business objectives and strategy? Is our organization focused on key risks that drive growth and enhance business performance? Do we make differential investments in strategic risks that matter to better enable business performance? Do we link our risk management efforts with business planning and performance management? Well prepared Requires consideration Operations Do we have a risk management policy adopted across the company (including subsidiaries, joint ventures and associates)? Do we have an effective risk management process/system to identify the following? Emerging risks Exposures stemming from operating plans Drivers of volatility that could impact business performance and strategic goals Country-specific risks Fraud vulnerabilities Do we consider linkage of risks across business units and critical functions while evaluating the overall risk profile of the company? Do we have a process/system in place to detect anomalies using analytics? Have we leveraged technology tools to operationalize risk management across the organization? Risk-adjusted business performance Do we have a process of incorporating the quarterly business performance feedback into risktrends and analysis? Do we perform a risk evaluation of strategic initiatives and risk-adjust capital allocations accordingly? Do we have a process of updating the risk appetite and risk tolerance levels with changes in a company s environment (economy, markets, regulation, technology) strategy and business performance? Governance Have we adequately appraised the board members and audit committee on the risk management related requirements of the Companies Act, 2013 and its impact on their responsibilities? Do we have a clear & consistent risk oversight at the board, audit committee & executive management levels? Do we have accountabilities defined throughout the organization? Do we independently review the robustness of the risk management process/systems? Do we reward/encourage behaviors/actions that drive and support risk management? Do we have a mechanism to measure, monitor and report results to executive management and the board? Do we have a program to train our employees on their role in the overall risk management process and appropriate behavioral responses in a variety of crisis scenarios?

4 Strategy Operations Risk-adjusted business performance Governance Notes 4 Companies Act

5 How can EY assist you in implementing a robust compliance management program? Areas of intervention Do I need support? Program set-up/improvement Assess the design of my risk management program Prepare a road-map for implementation and improvement considering maturity and leading practices Governance Design my risk management strategy and framework: Policy Structure Risk appetite and risk tolerance levels Strategic plan (future-state vision, philosophy, goals and objectives, key performance, indicators, timelines, resources and performance measurement) Accountability matrix (board, audit committee and executive management) Implementation Implement risk management process and/or targeted intervention to: Identify my risk universe and develop my risk library Identify and prioritize risks that matter Develop mitigation plans for risks that matter Develop a risk monitoring process Implement risk management technology tools such as SAP GRC, RSA Archer, EY s proprietary Risk Manager to automate risk monitoring process Define functional, technical requirements and design specifications Implement the future-state design Support with anomaly detection/early warning signal enablement through EY s data analytics lab Perform ongoing risk evaluation of strategic initiatives and risk-adjust my capital allocations Training Provide orientation to board members (including audit committee and independent directors) on Section 134 and their responsibilities Train employees on their role in the overall risk management process and on leading practices for managing emerging risks in areas such as treasury, information technology, fraud etc.

6 Leverage sector-specific centers of excellence (COEs) for challenges, risks and emerging trends impacting each sector Combined expertise in operations, HR, finance, treasury, IT, tax and legal Risk business insights Global risk radar report published annually, which includes our view of environmental risks and sector-specific risks that companies need to consider Functional insights Global view of risk radar In-depth experience of auditing risks emanating from functions across the enterprise Significant experience in auditing risks Why EY? Repository of leading practices and lessons learned Leading practices Technology capabilities Analytics Capability to deploy SAP GRC, RSA Archer and EY s in-house Risk Manager technology tool Ability to provide analytical support in identifying anomalies and outliers through our analytics lab 6 Companies Act

7 Notes

8 EY offices Ahmedabad 2 nd floor, Shivalik Ishaan Near C.N. Vidhyalaya Ambawadi Ahmedabad Tel: Fax: Bengaluru 12 th & 13 th floor UB City, Canberra Block No.24 Vittal Mallya Road Bengaluru Tel: Fax: (12 th floor) Fax: (13 th floor) 1st Floor, Prestige Emerald No. 4, Madras Bank Road Lavelle Road Junction Bengaluru Tel: Fax: Chandigarh 1 st Floor, SCO: Sector 9-C, Madhya Marg Chandigarh Tel: Fax: Chennai Tidel Park, 6 th & 7 th Floor A Block (Module 601, ) No.4, Rajiv Gandhi Salai, Taramani Chennai Tel: Fax: Hyderabad Oval Office, 18, ilabs Centre Hitech City, Madhapur Hyderabad Tel: Fax: Kochi 9 th Floor, ABAD Nucleus NH-49, Maradu PO Kochi Tel: Fax: Kolkata 22 Camac Street 3 rd floor, Block C Kolkata Tel: Fax: Mumbai 14 th Floor, The Ruby 29 Senapati Bapat Marg Dadar (W), Mumbai Tel: Fax: th Floor, Block B-2 Nirlon Knowledge Park Off. Western Express Highway Goregaon (E) Mumbai Tel: Fax: NCR Golf View Corporate Tower B Near DLF Golf Course Sector 42 Gurgaon Tel: Fax: th floor, HT House Kasturba Gandhi Marg New Delhi Tel: Fax: th & 5 th Floor, Plot No 2B, Tower 2, Sector 126, NOIDA Gautam Budh Nagar, U.P. India Tel: Fax: Pune C-401, 4 th floor Panchshil Tech Park Yerwada (Near Don Bosco School) Pune Tel: Fax: Ernst & Young LLP EY Assurance Tax Transactions Advisory About EY EY is a global leader in assurance, tax, transaction and advisory services. The insights and quality services we deliver help build trust and confidence in the capital markets and in economies the world over. We develop outstanding leaders who team to deliver on our promises to all of our stakeholders. In so doing, we play a critical role in building a better working world for our people, for our clients and for our communities. EY refers to the global organization and may refer to one or more of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients. For more information about our organization, please visit ey.com. Ernst & Young LLP is one of the Indian client serving member firms of EYGM Limited. For more information about our organization, please visit Ernst & Young LLP is a Limited Liability Partnership, registered under the Limited Liability Partnership Act, 2008 in India, having its registered office at 22 Camac Street, 3rd Floor, Block C, Kolkata Ernst & Young LLP. Published in India. All Rights Reserved. EYIN ED This publication contains information in summary form and is therefore intended for general guidance only. It is not intended to be a substitute for detailed research or the exercise of professional judgment. Neither Ernst & Young LLP nor any other member of the global Ernst & Young organization can accept any responsibility for loss occasioned to any person acting or refraining from action as a result of any material in this publication. On any specific matter, reference should be made to the appropriate advisor. For any queries on how EY can assist you: Please contact, ermsolutions@in.ey.com 8 Companies Act