Risk and control frameworks are, of course, shaped by relevant laws, regulator expectations, and industry standards. In regulated industries such as banking, capital markets, insurance and the like, compliance is more than a legal requirement; it's at the heart of risk governance.
Regulators will expect organisations to have effective controls, clear accountability, appropriate documentation, and evidence that risks are managed continuously. A framework will not be considered to be in place if records, testing or reports cannot show it.
Banking and prudential expectations
In banking, risk management is inextricably linked to prudential regulation. The Basel III standards are a prime example, with requirements on capital, liquidity, leverage, and how credit, market, and operational risk is managed. The aim is to ensure banks are strong enough to withstand stress and absorb losses without damaging the wider financial system.
In India, the RBI sets the rules on capital, exposures, and risk management through its prudential and Basel-related directions. The most recent RBI updates on Basel III credit risk are a case in point of the regulatory framework's increasing risk sensitivity over time.
SEBI and capital market compliance
In capital markets, regulators (e.g., SEBI) focus heavily on market integrity, investor protection, disclosure, governance, and cyber resilience. Firms must control client onboarding, trading, reporting, surveillance, vendor management, and technology risk. The bar is very high for business continuity, cyber monitoring, regulatory reporting, and escalation discipline. Because technology enables client and market activity, governance expectations are particularly high.
Industry-specific expectations
Every sector has its own compliance pressures. Banking focuses on credit risk, liquidity, AML, sanctions, and regulatory reporting, and is generally under close regulatory scrutiny. Manufacturing focuses on health & safety, environmental compliance, product quality, and supply chain integrity, and its compliance programmes must address the realities of operational risk and the complexity of operating across multiple jurisdictions. Healthcare is all about privacy, patient protection, and data governance, with a strong emphasis on confidentiality. Each has its own set of controls, but banking generally has the most formal risk framework and the most sophisticated real-time monitoring. Manufacturing will be more concerned with operational and worker-safety audits, and healthcare will be under a very heavy data-protection regime and clinical standards. The nature of the challenges, the controls, and the regulatory interface can differ significantly from one sector to the next.
The issues are very different in nature, but the control principles are the same: define obligations, assign responsibility, monitor performance, have evidence of controls in place, and fix issues quickly. An organisation that does this consistently will be in a much better position to meet regulator expectations. In practice, however, the same deficiencies often surface in an incident: poor governance, incomplete control design, poor escalation, slow remediation, and poor evidence. Consider a bank that identifies a suspicious transaction. It may well have the control in place, but it may not have the evidence to show that the control actually worked. It may not have documentation showing it followed the proper escalation process. If the regulator looks at that incident later on, they will have no audit trail and no evidence of the escalation. They therefore will have no way of knowing whether the control actually worked. The control is therefore effectively deemed to have failed, even if it was in fact in place.
That's why documentation is so critical. Regulators, auditors and supervisors need evidence. If a control isn't documented, reviewed and traceable, then it's very difficult to defend in an exam. To build a strong compliance programme, you need to adhere to documentation best practice, which includes: clear and up-to-date records of the control activity itself, use of standard templates, version control and secure storage of all documentation, robust evidence of testing and monitoring, regular review of the key documentation and, of course, archiving in line with the relevant regulatory retention requirements. All of these will help ensure your documentation is audit-ready and can be retrieved when required.
What good compliance looks like
A compliant organisation typically has:
- a clear inventory of the relevant regulatory obligations.
- assigned owners for each of the major controls and requirements.
- periodic testing and monitoring of control effectiveness.
- Issue management and remediation tracking.
- board and management reporting on risk and compliance status.
- evidence retention which will support audit and supervisory review.
These items go a long way to turn compliance from a simple checklist into a properly structured element of governance. The organisations that respond best have the strongest structure, the best oversight, and the most reliable evidence. It's not necessarily the ones with the most controls.
Next up is a look at the emerging trends in risk and control (AI, cyber security, ESG and integration across the organisation). To get started in this area, organisations could look at how AI is already used in their risk assessments or consider updating cybersecurity policies to address new threats. They could also explore mapping their ESG obligations or assign responsibility for emerging risks.