Shri Swaminathan J, Deputy Governor, Reserve Bank of India, has highlighted regulatory gaps in governance in a speech. He noted that boards must own outcomes, not paperwork. A diverse and independent board keeps an organisation on track by overseeing compliance, risk, culture, and ethics. Directors must exercise their duty of care and duty of loyalty. He noted that in large conglomerates, risk does not stop at the boundaries of individual entities. Boards should see the whole, not just the parts. Two steps help. First, ring-fence critical entities so a local problem does not become a group crisis.
Swaminathan also talked about risk management and compliance. Internal audit tests the system independently. The Heads of assurance functions (the Chief Risk Officer, Chief Compliance Officer, and Head of Internal Audit) must have access to the board and to any business line that can create material risk. They should have adequate budgets and full access to information. Decisions on their appointment and removal should rest with the board. Weak lines of defence are to be seen as a board failure, not a staffing glitch.
He noted that Modern business is not tidy. A listed company can be part of a conglomerate with banks, NBFCs, insurers, brokers, payment firms, tech subsidiaries, overseas arms, and associates. The regulatory map is equally rich. In such an environment, regulators must balance entity and activity-based regulation. Regulate the activity wherever it happens, and keep stronger rules for entities that hold public trust. Regulators should scale requirements to risk and complexity. He also noted importance of outcome-based regulation, calibrated to market maturity.