Risk Management in a Volatile World: Beyond Compliance

There was a meeting I remember during my tenure at Bajaj Auto. It was a CFT-management review – like the product development meetings with manufacturing teams, supply chain heads, marketing and finance teams. Neither a specific finance review meeting nor a compliance audit. We were building the world’s first CNG motorcycle. The question by the executive director was not related to any “regulatory limit compliance”. It was: “What happens to the business case if the CNG pumps do not push the required pressure out to our tanks? What happens to our internal rate of return if the market demography is limited to urban-only for the initial two years? And how will it impact our break-even?”

Some questions – uncomfortable, cross-functional, and financially rigorous – reveal the true essence of risk management when it is implemented in strategic conversations. It is not limited to a risk register or to checking boxes in NPD playbooks.

The world is moving at the speed of 2026, requiring organizations to make that shift “immediately, if not soon”. The gap is becoming a competitive liability.

Risk managers, you were not ready for this.

Traditional risk management was simple, elegant yet myopic: identify threats, inform cross-functional members, stay within compliance limits and have a good sleep. Regulations moved slowly, and the global supply chain industry did not fear US presidents. Geopolitics was background noise.

Then 2020 happened. And 2021. And the world came on standby.

“Semiconductor shortages have impacted nearly all global auto manufacturers, creating production halts and backlogs. The annual worldwide production losses were estimated as $110 billion by May 2021” [PubMedCentral]. The shortage was not due to any product failure, nor from a compliance breach, but from a semiconductor shortage, which no one could have predicted at first, due to COVID.

This was not a risk management failure in the traditional sense. The manufacturing plants were safe, and the balance sheet statements guaranteed growth. Compliance was within limits. But the risk was bigger – the absence of strategic, insightful thinking. Nobody would have given a thought to how a tier-3 semiconductor manufacturing company in Taiwan would be critical to supply the tier-2 suppliers of various OEMs and disrupt the entire product line!

Risk is not a department. It is a strategic discipline.

I spent over four and a half years managing new product development programs with the two-wheeler automobile giants Bajaj Auto and Hero MotoCorp. Products didn’t just survive technical gate validations and approvals – but hard financial truths: NPV scenarios, IRR sensitivity analysis and EBITDA improvement roadmaps under multiple case scenarios and market considerations. Product cost waterfalls are built through comprehensive cost analysis. Every product had a well-defined business case, and every business case had risk embedded in it.

What I learned: risk management is most powerful at the very beginning, when the product charter and scope is being shaped. When product market geography and demographics are defined, and targets are set, the risk variables are not just the regulatory compliance in the country. They are currency risks due to exchange rate volatility, demand cycle risk (surplus and shortage risk) due to shifts in consumer behaviors, technology risk for new diverse geographic conditions and geopolitical risks emerging from constrained relationships. Stress testing each of these dimensions and getting the business case right is what produces a project worth every investment.

How finance leaders must evolve

The three risks which most organizations are misreading, where the gap between stated risk appetite and actual risk readiness is huge, are technology transition risk, supply chain concentration risk and regulatory evolution risk. Enterprise risk management teams need to make the transition from maintaining the traditional risk register to strategic management tools, no longer for just risk controls but to base the organization-level decisions - such as investments, growth strategies and international expansions - on them.

Various audit firms reflected the integration failure of ERM insights with strategic decision-making. Since risk management is a discipline, as is strategy. Finance needs to act as the bridge connecting the insights of risk management and strategic decision-making. A dynamic financial business case is required to cater to all the expected probabilities for calculating the IRR – what happens for P10, P50, and P90 demand scenarios? The business case needs to shift from a single value IRR to dynamic values backed with analytical rationales. What happens to the payback period if the material cost moves up by 20%? How sensitive are the EBITDA values in case the market and manufacturing variables, or currency depreciations, face a hit?

The strategic mindset

The product development divisional heads and risk officers must speak the same language. Enterprise risk management is bridging the gaps between strategy, law and finance. The finance professionals who will create value over the next 5 years are not limited to just keeping the statements clean, but also those who look at the business case sitting in the gate review meetings and ask questions about the challenges which the organizations will face in the next 5 years.

The world’s first CNG motorcycle was not built by the people who just managed risks by filling the risk registers. It was built by people who stress-tested the product and made strategic bets with their senses open.

Risk management as a function has protected organizations in the past. Finance as a strategic discipline will prepare organizations for the future.