Governance
Group-Wide Risk Management Framework for Business Groups
By ATTPL HOLDCO / ATTPL GROUP Editorial Team · · 3 min read
Build a simple group-wide risk management framework: risk register, scoring, owners, controls and board reporting for multi-company Indian business groups.
Why a group needs one view of risk
Every company in a group faces its own risks: a construction business worries about site safety and project delays, a finance business about credit and fraud, a technology business about data security. Managed separately, these risks can look small. Seen together, they may add up to something the group cannot absorb, such as several companies depending on the same bank line, the same key customer or the same IT system.
A group-wide risk management framework brings these risks into one view, so the leadership team and the board can decide which ones to accept, reduce, transfer or avoid. It does not need to be complex. For most Indian small and mid-sized groups, a clear process run consistently matters more than sophisticated software.
Board responsibility for risk
The Companies Act, 2013 asks the board's report to include a statement on the development and implementation of a risk management policy, and audit committees, where they exist, review internal financial controls and risk management systems. Listed companies have additional requirements under SEBI regulations. Even where the law asks little, lenders, insurers and large customers increasingly expect a group to show how it identifies and manages its main risks.
Step 1: Agree categories and appetite
Start by agreeing on a small set of risk categories that every company uses, for example:
- Strategic: market changes, competition, regulation and reputation.
- Financial: liquidity, borrowing, credit, currency and fraud.
- Operational: safety, quality, supply chain, people and key-person dependence.
- Technology: cyber attacks, data loss and system outages.
- Compliance: statutory filings, licences, tax and labour laws.
Then agree the group's risk appetite in plain words. For example, the group may accept moderate commercial risk on new projects but have almost no appetite for safety incidents, fraud or missed statutory deadlines.
Step 2: Build a risk register
A risk register is a simple table, kept by each company and combined at group level. For each risk, record:
- A clear description of the risk and its cause.
- Likelihood and impact scores on a simple 1 to 5 scale.
- Existing controls and how well they work.
- A named risk owner, usually a senior manager, not a department.
- Planned actions, deadlines and the residual score after action.
Keep the register short and current. Twenty well-described risks reviewed every quarter are more useful than two hundred that nobody reads.
Step 3: Connect risks to controls and assurance
Each major risk should link to specific controls, such as approval limits, reconciliations, safety checklists, backups or insurance cover. Internal audit then tests whether those controls actually work, as explained in our guide to internal audit for group companies.
Technology risk deserves special attention because one weakness can affect every company that shares the same systems. A basic cybersecurity checklist for small businesses from ATTPL IT is a practical place to start. For severe events such as floods, fires or system failures, link the register to a tested plan, as described in our article on business continuity planning for business groups.
Step 4: Report simply and regularly
Risk reporting works best when it fits into existing meetings rather than creating new ones. A practical rhythm is:
- Monthly: each company reviews its top risks in its management meeting.
- Quarterly: group finance or the risk lead combines registers into a one-page group risk dashboard.
- Quarterly or half-yearly: the audit or risk committee reviews the dashboard, new risks and overdue actions.
- Annually: the board reviews risk appetite, the policy and the overall framework.
Use a heat map to show where the biggest risks sit, and always highlight risks that are rising or actions that are late.
Common mistakes to avoid
- Treating the register as a compliance document that is updated once a year.
- Listing risks without owners, deadlines or clear actions.
- Ignoring concentration risks that cut across companies, such as one banker or one major customer.
- Scoring every risk as medium, which hides the ones that really matter.
How the holding company supports group risk management
At ATTPL (ऐट्प्ल) HOLDCO - GROUP, the holding company provides common risk categories, scoring scales and reporting templates, while each operating company owns and manages its own risks. If your group wants to set up or refresh its risk framework, contact us to start the conversation.
Frequently asked questions
What is the difference between risk management and internal audit?
Management identifies and manages risks day to day. Internal audit independently tests whether the controls for those risks are designed well and working as intended.
How often should a risk register be updated?
Review top risks monthly within each company and update the full register at least quarterly, or immediately when a major change or incident occurs.
Does a small group need risk management software?
Not at first. A well-structured spreadsheet with clear owners and regular reviews is enough for most small and mid-sized groups. Software can come later as the number of risks and users grows.
Sources and further reading
This article is general information, not legal, financial or risk advisory advice.
