A WELL-GOVERNED RISK MANAGEMENT FRAMEWORK IS THE NEED OF THE HOUR

The Model Risk Code (MRC), a practical playbook meant to ‘enable faster, bolder, risk-intelligent decisions’ for corporates, was released recently by the Global Risk Management Institute (GRMI) and the Federation of Indian Chambers of Commerce & Industry (FICCI).

- Amisha Sharma

The MRC release event held on November 24, 2022 at the FICCI Federation House in New Delhi, saw industry stalwarts speak about how vital risk management practices are in the current scenario. The Model Risk Code has primarily been authored by Subhashis Nath, Founder & CEO of GRMI, and Founder of Axis Risk Consulting, now Genpact Enterprise Risk Consulting, with guidance from an 18-member Risk Taskforce led by M. Damodaran, Chairperson, Excellence Enablers and former Chairman, Securities and Exchange Board of India (SEBI). At the MRC release event, Subhashis Nath spoke about the six myths that the MRC intends to remove in businesses. Elucidating on the first myth, he said, “The first myth is about internal audit function taking on the role of risk management function. Internal audit function cannot extend itself to play the role of a risk management function, as internal audit is an independent third line of defense, i.e. more of a monitoring function. Risk management needs to be owned and managed by the business -- first and second lines of defense.” Dwelling on the second myth, he stated, “The Chief Risk Officer (CRO) cannot afford to be more than one level below the Managing Director or the CEO in the organisational hierarchy.

The notion that a CRO needs to report to the Chief Financial Officer (CFO) is fundamentally flawed because you accept that the individual does not need to be at the table where critical decisions happen. Hence, the CRO needs to report to either the Risk Management Committee (RMC) or at best to the Managing Director or the Chief Executive Officer while having access to the RMC.”