1. Dolly Dhamodiwala CEO, Business Beacon Management Consultants
Risk Management and Internal Controls in Family Managed Medium sized Listed Companies
Dolly Dhamodiwala
CEO, Business Beacon Management Consultants

2. Risk Management- A Key Focus Area for Directors of All Companies
Biggest Challenge for Promoters- Understanding the multiple forms of risks faced by their organization
Are companies in India, especially SMEs and Unlisted companies adequately equipped to manage the emerging and newer forms of risks ?
The board’s role has become more complex. This is due to Increasingly dynamic global economy, Political uncertainty, Increased Investor Involvement, Funds Constraints, Disruptive Technologies and an active M&A environment.
Effective Risk Management is an integral component of Strategy Formation and Company Performance

3. Types of Risks
Risk is defined as the Combination of the Probability of an Event and its Consequence. The Consequence can be Positive or Negative (Institute of Risk Management - IRM,UK). Thus risk is the Effect of Uncertainty on Objectives – Positive, Negative or a Deviation from the Expected
Hazard or Pure risks – Operational or Insurable.
Control or Uncertainty risks- Associated with Project Management
Opportunity or Speculative risks- Capital Market Risks Usually taken to achieve a positive result

4. Categories of Risks Internal External Financial Risks
Liquidity (Inability to meet Liabilities) Cash-Flow
Profitability
Interest rate fluctuations
Exchange rate fluctuations
Credit Default/Counterparty Defaults
Capital Market Fluctuations
Price Fluctuations
Strategic Risks
R & D M & As
Reputational
Intellectual Capital Competition Customer changes Industry changes
Operational Risks
IT Systems & Security Accounting Controls Supply Chain
Communications
Process Mgt. & Execution
Delivery, Business Interruptions/Model Failure
Project Cost Overrun/Time Overrun
Fraud
Regulations & Compliance
Legal Actions
Unsatisfactory Service Providers
Hazard Risks
Employees Properties
Natural Events Suppliers Environment ( Eco/Pol./Country/Intl.) Contracts & Obligations

5. Drivers of Risks
Source: Based on FIRM Risk Scorecard risk classification system- UK Risk Mgt. Std. IRM & ISO 31000

6. What is Risk Management
Risk Management - A Process which aims at helping organizations understand, evaluate and take action on all their risks with a view to increasing the probability of success and reducing the likelihood of failure – IRM
Traditional Risk Management takes care of individual risks but fails to address the inter-relationship between different risks and their impact

7. What is Enterprise Risk Management (ERM)
ERM – A Process effected by an entity’s Board of Directors, Management and other personnel, applied in Strategy setting, and across the enterprise, designed to identify potential events that may affect the entity, manage risk to be within its risk appetite and to provide reasonable assurance regarding the achievement of the entity’s objectives.
Simply put, ERM constitutes ‘All the processes involved in identifying, assessing and judging risks, assigning ownership, taking actions to mitigate or anticipate them and monitoring and reviewing the progress’.

8. Benefits of ERM
Improvement in Operational Performance – Effective Achievement of Core Business Objectives
Better Financial Performance – Improvement in Key Financial Performance Indicators, Greater Stakeholder and Investor Confidence, Better Credit Rating and Company Valuation and Reduction in Insurance Costs.
Effective Use of Resources and Better Management of Capital and Investments
Increased Consistency and Communication of Risks within the company – Standard Conceptual Framework
Improved Focus and Perspective to Risk Data for better quantification of risk factors and tolerances

9. Benefits of ERM
Information based Decisions – Strategic Decisions based more on Informed Judgment supported by Enterprise wide Data and Risk factors and Company’s Risk Appetite.
Selection of best possible responses to various risks and reduction of losses
Better management of multiple and cross-enterprise risks which are generally inter-related.
Better management of Competitive Markets and Dynamic Economic Trends
Use of key risk metrics and measurement of risks improves the value of reporting and analysis
Assurance of Appropriate Internal Controls and Reduction in Cost of Audit

10. Five Major ERM Processes
Risk Identification – Action in Advance. All Potential risks, Positive and Negative Identified
Assessing the Impact – Promotes a Risk Awareness Culture and a sense of Accountability
Risk Analysis and Evaluation – Assessment of Significance, Probability of Occurrence and Impact. Helps in Assignment of Ownership, Strategy Formulation and Internal Controls
Risk Treatment – Alleviating the shocks of Negative Risks and Taking Advantage of Positive Risks. Leads to better Operational Efficiency and Higher Profitability
Risk Monitoring & Review. – Helps in framing an effective Business Strategy

11. Risk Treatment – Responses to Risks
The Four T’s for Responding to Risks are:
Risk Tolerance – When no action can be taken the Risk has to be Tolerated
Risk Treatment – Action taken to Contain the Risk to an Acceptable Level while continuing with the activity
Risk Transfer – Conventional Insurance or Third Party assuming the Risk
Risk Termination – Avoidance of Activities inducing the Risks when none of the above three are possible

12. Controls for Risks
Risk controls are prescribed based on the Impact and Probability of Each risk
Directive Controls – Directions given to Executives in advance for High Impact Risks
Detective Controls – Aimed at Identifying the events with undesirable outcomes for Low Impact Risks
Corrective Controls – For Treatment of Risks to reduce their Impact and reduce Losses
Preventive Controls – Aimed at limiting the possibility of Negative Impact for High Impact High Probability risks which need to be terminated
Directive – Directions to Executives in advance – Hedging, Low cost Borrowing, Reduction in cost of Production, etc.
Detective – Audit Reports, MIS reports, Controls on Accessibility, Reviews by AC, Information flows, Outcomes envisaged, etc.
Corrective – HR issues, Supply chain alterations, Market segment alterations, etc
Preventive – Negative impact of Reputational risks, natural Calamities, Insurance of Assets, etc.