Prethona Financial Services Ltd., was a company providing financial services, and had offices located across all the major cities in India. Considering the nature of the industry it was functioning, the Company required

Several large companies and financial institutions worldwide no longer exist or have been taken over precisely because they neglected the basic rules of risk management and control. Some common risk management problems in relation to corporate governance that appeared in many financial institutions before and during the crisis according to the OECD (2009) was because: Risks were frequently not linked to strategy which is a key issue to ensuring that risk management has a focus on the business context; Risk definitions are often poorly expressed. Better risk definitions (context, event, consequence) are contrary to a lot of current thinking in risk management which has shorten risk descriptions to the smallest number of words possible; Organizations weren't always in a position to develop intelligent responses to risks; Boards didn't take stakeholders and guardians into account in detailing responses to risk; Important parts of the value chain were outsourced to others. To accomplish all these, certain review mechanisms are necessary on the part of the board, which have been detailed in COSO's 2010 progress report; the board must, inter alia, review: The company's procedures for (a) identifying when risks arise and (b) the actions to be taken if material risks arise; The quality and types of risk-related information provided to the board; Management's implementation of the company's risk policies and procedures and their communication across the firm; The company's risk management functions; Reports from internal and external experts, such as auditors, legal counsel and analysts, to ensure that appropriate risks are being considered; Whether the board members primarily tasked with risk oversight have the necessary experience, knowledge and expertize to oversee the company's risk management matters, and provide directors risk education as necessary; The qualifications and backgrounds of risk management personnel and policies applicable to the risk management personnel, to access whether they are appropriate in their positions while giving consideration to the companies size and scope of operations.