The Applicability Test
Regulation 21 of SEBI LODR requires the constitution of a Risk Management Committee for: the top 1000 listed entities determined on the basis of market capitalisation at the end of the immediately preceding financial year; and high-value debt listed entities with outstanding non-convertible debt securities of ₹500 crore or more. The Companies Act, 2013 does not independently mandate an RMC; the obligation is a LODR requirement. A listed entity outside the top 1000 and below the debt threshold is not required to constitute an RMC, though it may do so voluntarily.
Composition and Meetings
The RMC should have a minimum of three members, with the chairperson being a member of the board. The majority of the members should be members of the board. For top 100 listed entities, the composition requirements are more specific. The committee should meet at least twice a year, and the minutes should record the risk items discussed and the management’s response.
The Risk Framework Oversight
The RMC’s role is to oversee the company’s risk management framework, including: the identification of principal risks; the risk appetite and tolerance levels; the mitigation plans; the monitoring and reporting mechanisms; and the integration of risk management with strategy. The committee should review the risk register and the heat map, not merely receive a presentation on “key risks.”
The Risk Register
The company should maintain a risk register that records: the risk category; the likelihood and impact assessment; the risk owner; the mitigation action; the residual risk rating; and the review date. The RMC should review the register at each meeting and track the movement of high-priority risks. A register that is not updated between meetings is a static document, not a management tool.
The Cyber and ESG Overlay
For listed entities, the RMC’s remit increasingly includes cyber risk and ESG-related risks. The committee should receive specific updates on cyber incidents, data breaches, and the company’s preparedness against emerging risks. The ESG risk assessment should be integrated into the enterprise risk framework, not treated as a separate sustainability report exercise.
Documentation for the Board
The RMC’s minutes and recommendations should be placed before the board. The board’s report should disclose the committee’s composition, meetings, and the risk framework’s key features. A board that receives the RMC minutes without discussing the high-priority risks is not providing effective risk oversight.
Call to Action: For RMC charter design, risk register review, or LODR risk governance compliance, contact office@anujdesaiassociates.com or 9619456656. Website: https://anujdesaiassociates.com. LinkedIn: linkedin.com/in/ca-anuj-desai-122547230.