The CFO of a well-known public company (one among top 20 listed companies) suggested to the Board of directors to constitute a Risk Management Committee with only the CFO and General Manager (HR) as its members. The Comp

As per Regulation 21 of SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015 (LODR), the Board of top 1000 listed companies shall constitute a Risk Management Committee (RMC). The top 1000 listed entities shall be determined on the basis of market capitalization as at the end of immediate preceding financial year and high value debt listed entities. The Risk Management Committee shall have minimum three members with majority being members of Board of Directors (BOD) including at least one independent director. In case of a listed entity having SR equity shares, at least two thirds of the members of RMC shall be independent directors. The chairman of RMC shall be a member of the BOD. Senior executives may be members of RMC. The RMC shall meet at least twice in a year. The quorum for the meeting of RMC shall be either two members or one third of the members of the RMC whichever is higher including at least one member of the BOD in attendance. Not more than 180 days shall lapse between two consecutive RMC meetings. The BOD shall define the role and responsibility of RMC and may delegate monitoring the risk management plans of the company to the RMC including cyber security. In the instant case, as the company is among the top 20 public listed companies based on market capitalization, it is required to constitute RMC with independent directors, members of Board of Directors and senior executives. However, the Chairman of RMC has to be a Director of the company. Hence, the Company Secretary may be included as a member of the RMC, his contention that he should be made Chairman is wrong. Also, the contention of the CFO to constitute RMC only with senior officers of the company is not correct.