Compliance, Risk & ESG
Know which risks would actually stop the business, and hold the regulatory ground your sector stands on.
The situation
Most risk registers in smaller businesses are documents produced once for somebody else — a lender, an auditor, an investor — and never opened again. Meanwhile the exposures that would actually stop the business are usually known to everyone and written down nowhere: one customer at forty per cent of revenue, one supplier with no alternative qualified, a licence renewal that depends on a relationship, a key person whose knowledge exists in no system. Risk work that matters is not about listing what could go wrong. It is about establishing which two or three things would end the business, and what it costs to make each of them survivable.
You are probably
here because
- One customer, one supplier or one person represents a share of the business that nobody has said out loud in a board conversation.
- Compliance is handled reactively, by whoever notices the deadline, and the answer to whether the firm is currently compliant is a shrug.
- An investor or lender has asked for diligence material and assembling it has become a project in itself.
Who this
is for
Regulated and semi-regulated businesses — NBFCs, jewellery, F&B — and anyone preparing for investor diligence.
What the first
fortnight produces
We work from concentration outward: revenue by customer, supply by source, capability by person, and the regulatory obligations your sector actually carries as opposed to the generic list. What comes back is short — the two or three exposures that would genuinely stop the business, what each would cost to mitigate, and what the firm can reasonably choose to carry. A register nobody opens is worse than no register, so the output is sized to be acted on.
How the work
is scoped
A concentration and compliance review is a short fixed-fee piece and is often taken on its own ahead of a funding round or a lender conversation. Ongoing compliance advisory is usually structured as a retainer, because obligations arrive on a calendar rather than in a project. ESG work is scoped to what the business will actually be asked for by its investors or buyers, which for most Indian SMEs is considerably less than a full framework.
The 3 service lines
What you can buy here01
Risk Management & Mitigation
Operational, financial and reputational risk assessed and turned into an actionable plan, not a register nobody opens.
02
Regulatory & Compliance Advisory
GST, RBI, FDI and sector-specific norms, applied to how your business actually operates.
03
ESG Advisory
Sustainability benchmarks for investor and regulatory readiness, at a scope an SME can sustain.
Questions we get asked
Answered straightWhat regulations apply to us specifically?
That depends on sector and structure, and the honest first step is establishing it rather than assuming. GST and company law apply broadly; RBI norms bind if you are lending or handling deposits; FDI rules bind if foreign capital is involved; and sectors like jewellery, food and NBFC carry their own regimes with their own inspection regimes. The review establishes which of these are live for you and where the current gaps are.
How much customer concentration is too much?
There is no universal number, but the question to ask is what happens to the next twelve months if the largest customer leaves — and whether the business could survive that while replacing them. Concentration is not automatically a problem; concentration without a costed plan for its loss is. Most owners know the percentage and have never modelled the consequence.
Do we need ESG at our size?
Only to the extent that someone is going to ask for it — most commonly an institutional investor, a large customer with its own reporting obligations, or an overseas buyer. Building a full framework speculatively is a waste of an SME's capacity. The useful version establishes what you will actually be asked for and gets that in order.
Is this an audit?
Not a statutory one. Independent management audits under IMCI-certified standards sit under the IMCI-Backed Credibility practice; this work is advisory and produces a plan rather than an opinion.
What we have written about this
The thinking behind the practiceStart the conversation
Free · 30 minutes · senior consultantTell us where the business stands and where you want it to go. We will bring our first read on compliance, risk & esg — and an honest answer on whether we can help.