Conscious that no entrepreneurial activity can be undertaken without assumption of risks and associated reward opportunities, the Company operates on a risk management process/ framework aimed at minimization of identifiable risks after evaluation so as to enable management to take informed decisions. 

Broad outline of the framework is as follows: 

• Risk Identification:
  Management identifies potential events that may positively or negatively affect the Company’s ability to implement its strategy and achieve its objectives and performance goals.
  
  Risks can be identified under the following broad categories. This is an illustrative list and not necessarily an exhaustive classification.

• • Internal risks including:
    1. Strategic Risk: Competition, inadequate capacity, high dependence on a single customer/vendor.
    2. Business Risk: Project viability, process risk, technology obsolescence/ changes, development of alternative products.
    3. Finance Risk: Liquidity, credit, currency fluctuation.
    4. Environment Risk: Non-compliances to environmental regulations, risk of health to people at large.
    5. Personnel Risk: Health & safety, high attrition rate, incompetence.
    6. Operational Risk: Process bottlenecks, non-adherence to process parameters/ pre-defined rules, fraud risk.
    7. Reputation Risk: Brand impairment, product liabilities.
    8. Regulatory Risk: Non-compliance to statutes, change of regulations.
    9. Technology Risk: Innovation and obsolescence.
    10. Information and Cyber Security Risk: Cyber security related threats and attacks, Data privacy and data availability.
  • External risks including:
    1. Sectoral Risk: Unfavourable consumer behavior in relation to the relevant sector etc.
    2. Sustainability Risk: Environmental, social and governance relates risks.
    3. Political Risk: Changes in the political environment, regulation/ deregulation due to changes in political environment.
    4. Root Cause Analysis: Undertaken on a consultative basis, root cause analysis enables tracing the reasons / drivers for existence of a risk element and helps developing appropriate mitigation action.
• Root Cause Analysis:
  Undertaken on a consultative basis, root cause analysis enables tracing the reasons/ drivers for existence of a risk element and helps developing appropriate mitigation action.
• Risk Categorization:
  The identified risks are further grouped in to (a) preventable; (b) strategic; and (c) external categories to homogenize risks.
  1. Preventable risks are largely internal to the Company and are operational in nature. The endeavour is to reduce /eliminate the events in this category as they are controllable. Standard operating procedures and audit plans are relied upon to monitor and control such internal operational risks that are preventable.
  2. Strategy risks are voluntarily assumed risks by the senior management in order to generate superior returns / market share from its strategy. Approaches to strategy risk is ‘accept’/‘share’, backed by a risk- management system designed to reduce the probability that the assumed risks actually materialize and to improve the Company’s ability to manage or contain the risk events should they occur.
  3. External risks arise from events beyond organization’s influence or control. They generally arise from natural and political disasters and major macroeconomic shifts. Management regularly endeavours to focus on their identification and impact mitigation through ‘avoid’/‘reduce’ approach that includes measures like business continuity plan / disaster recovery management plan / specific loss insurance / policy advocacy etc.

• Risk Prioritization:
  Risks are prioritized for mitigation actions and reporting based on how they affect the company.
• Risk Mitigation Plan:
  Management develops appropriate responsive action on review of various alternatives, costs, and benefits, with a view to managing identified risks and limiting the impact to tolerance level. Risk mitigation plan drives policy development as regards risk ownership, control environment timelines, standard operating procedure, etc. Risk mitigation plan is the core of effective risk management. The mitigation plan covers:

1. 1. Required action(s);
   2. Required resources;
   3. Responsibilities;
   4. Timing;
   5. Performance measures; and
   6. Reporting and monitoring requirements
      
      The mitigation plan may also covers: 

1. 1. preventive controls – responses to stop undesirable transactions, events, errors or incidents occurring;
   2. detective controls – responses to promptly reveal undesirable transactions, events, errors or incidents so that appropriate action can be taken;
   3. corrective controls – responses to reduce the consequences or damage arising from crystallization of a significant incident.
      
      Therefore, it is drawn with adequate precision and specificity to manage identified risks in terms of documented approach (accept, avoid, reduce, share) towards the risks with specific responsibility assigned for management of the risk events.

• Risk Monitoring:
  It is designed to assess on an ongoing basis, the functioning of risk management components and the quality of performance over time. Staff members are encouraged to carry out assessments throughout the year.

  Fraud & Operations Risk, team works on a robust and dynamic real-time transaction monitoring mechanism via an automated rule engine already in place. This engine functions basis predefined set of rules. Our Operations Risk team comprises Risk Experts and Data Scientists who evaluate and monitor merchant transaction and market trends to raise alerts which are actioned as per the alert monitoring protocols.

• Options for dealing with risk:
  There are various options for dealing with risk.

  Tolerate – If we cannot reduce the risk in a specific area (or if doing so is out of proportion to the risk) we can decide to tolerate the risk i.e., do nothing further to reduce the risk. Tolerated risks are simply listed in the corporate risk register.

  Transfer – Here risks might be transferred to other organizations, for example by use of insurance or transferring out an area of work.

  Terminate – This applies to risks we cannot mitigate other than by not doing work in that specific area. So, if a particular project is of very high risk and these risks cannot be mitigated, we might decide to cancel the project.

• Risk Reporting:
  Periodically, key risks are reported to the Board or risk management committee with causes and mitigation actions undertaken/ proposed to be undertaken. The internal auditor carries out reviews of the various systems of the Company using a risk based audit methodology.

  The internal auditor is charged with the responsibility for completing the agreed program of independent reviews of the major risk areas and is responsible to the audit committee which reviews the report of the internal auditors on a quarterly basis.

  The statutory auditors carry out reviews of the Company’s internal control systems to obtain reasonable assurance to state whether an adequate internal financial controls system was maintained and whether such internal financial controls system operated effectively in the company in all material respects with respect to financial reporting.

  On regular periodic basis, the Board will, on the advice of the audit committee, receive the certification provided by the CEO and the CFO, on the effectiveness, in all material respects, of the of the risk management and internal control system in relation to material business risks.

  The Board shall include a statement indicating development and implementation of a Risk Assessment and Management Policy for the Company including identification of elements of risk, if any, which in the opinion of the Board may threaten the existence of the Company.

• Risk Management Measures adopted in general by the Company:
  The Company has adopted various measures to mitigate the risk arising out of various areas described above, including but not limited to the following:

1. 1. A well-defined organization structure;
   2. Defined flow of information to avoid any conflict or communication gap;
   3. Hierarchical support personnel to avoid work interruption in absence/ non-availability of functional heads;
   4. Discussion and implementation on financial planning with detailed business plans;
   5. Detailed discussion and analysis of periodic budgets;
   6. Employees training and development programs;
   7. Internal control systems to detect, resolve and avoid any frauds;
   8. Systems for assessment of creditworthiness of existing and potential contractors/subcontractors/ dealers/vendors/ end-users;
   9. Redressal of grievances by negotiations, conciliation and arbitration; and
   10. Defined recruitment policy.