Most Indian enterprises have insurance. Fewer have risk management. Insurance is a financial instrument that transfers the economic consequences of specific, defined events to an insurer. It does not prevent the event from occurring, does not protect non-financial consequences such as reputational damage or operational disruption, and covers only the categories of risk that were anticipated and insured against.

Enterprise Risk Management — ERM — is the systematic process of identifying, assessing, and managing the full range of risks that could affect an organisation's ability to achieve its objectives. It encompasses financial, operational, strategic, technology, regulatory, and reputational risk. It is not a compliance exercise. It is a management discipline.

SEBI's requirements for risk management committees in listed companies have been strengthened. RBI's Integrated Ombudsman Scheme creates financial consequences for operational failures. The DPDPA creates liability for data protection failures. The Insurance Regulatory and Development Authority has increased focus on operational resilience in insurers.

Beyond regulatory compliance, the business case for ERM is straightforward. The companies that identified concentration risk in their supply chains before COVID avoided the worst disruptions. The companies that had documented business continuity plans for technology failures recovered from ransomware attacks faster. The companies that conducted formal competitive risk assessments recognised market disruption signals earlier than those that did not.