Compliance risk management is the discipline of deciding which statutory obligations could hurt your company most, how likely each is to fail, and what controls stand between a failure and a penalty, prosecution or business stoppage. It is different from compliance management, which is the day-to-day work of filing returns and maintaining registers. A company can file everything it remembers to file and still carry serious risk, because nobody ranked what could go wrong or checked whether the controls actually hold.
Most Indian companies manage this by instinct: whichever deadline is closest or whichever notice arrived last gets attention. This guide replaces instinct with a six-step framework built for Indian statutory compliance, covering EPF, ESIC, the Factories Act, Shops & Establishment Acts, CLRA, Professional Tax and Labour Welfare Fund. If you are looking for a one-time check of your current gaps, our Compliance Risk Audit guide covers that. This piece covers what comes after: the standing system that keeps risk visible and falling.
What Compliance Risk Management Covers, and What It Does Not
Compliance risk is the chance that your company fails to meet a legal obligation and suffers a consequence: interest and damages, prosecution of the occupier or officers, licence suspension, a stalled funding round or a failed due diligence. Risk management is the loop that finds those chances, ranks them, assigns them an owner, controls them and watches them over time.
It does not replace filing work. It decides where filing effort and review attention go first. A company with 40 contractors and 3 factory licences does not have the same top risks as a 12-person office in one state, and a framework makes that difference explicit instead of leaving it to whoever is loudest in the monthly meeting.
The Five Categories of Statutory Compliance Risk
Grouping risks stops the register from becoming an unreadable list of 200 items. Five categories cover nearly every statutory exposure an Indian employer faces:
- Filing and payment risk. Late or wrong EPF ECR (due the 15th of each month), ESIC contributions, Professional Tax returns and Labour Welfare Fund deposits. Late EPF remittance attracts interest under Section 7Q and damages under Section 14B of the EPF & Miscellaneous Provisions Act, 1952.
- Registration and licence risk. A factory licence, Shops & Establishment registration, CLRA registration or contractor licence that lapses or was never obtained for a new location.
- Record and register risk. Missing, outdated or wrongly formatted statutory registers, such as the Form 25 Muster Roll and Form 17 Overtime Register used for factory compliance, or the CLRA registers and employment cards in Forms XII to XIV.
- Third-party risk. A contractor who stops remitting EPF or ESIC. Under the Contract Labour (Regulation and Abolition) Act, 1970, the principal employer carries liability for specified contractor failures.
- Regulatory change risk. A new notification, circular or state amendment that makes a currently correct process wrong. This category matters more now: the four Labour Codes took effect on 21 November 2025, with detailed Central and State rules still being finalised.
Step 1: Identify Every Obligation in a Register
The foundation is a risk register: one row per obligation, per location. For each row record the act, the form or filing, the frequency, the due date, the authority, the location and the current owner. A manufacturer with two states and three sites will usually land between 80 and 150 rows. That count is normal, and it is the reason a spreadsheet kept in one person’s head stops working.
Build it from three sources: your registrations and licences (what you are legally covered by), your payroll and headcount data (which thresholds you have crossed, such as ESI coverage), and your contractor list (every vendor engaged on site). Anything that triggers on an event, like a new branch or the first contract labour engagement, needs its own row with a trigger note rather than a calendar date.
Step 2: Assess Likelihood and Impact
Score each register row on two scales from 1 to 5 and multiply. Likelihood asks how probable a failure is given your current process, people and data. Impact asks how bad it is if it fails: the money, the personal exposure of the occupier or officers, whether operations can continue, and whether it would surface in due diligence. The bands below are an illustrative starting point; calibrate them to your own size and appetite.
| Illustrative risk | Likelihood (1-5) | Impact (1-5) | Score | Band |
|---|---|---|---|---|
| Contractor stops remitting EPF/ESIC for deployed workers | 3 | 5 | 15 | High |
| Labour Codes rules change and processes are not updated | 3 | 4 | 12 | Medium |
| Factory licence renewal lapses at one site | 2 | 5 | 10 | Medium |
| EPF ECR filed after the 15th | 3 | 3 | 9 | Medium |
| Register format outdated after a state amendment | 3 | 3 | 9 | Medium |
| S&E registration missing for a newly opened branch | 2 | 4 | 8 | Medium |
Use bands of 1 to 6 for Low, 7 to 12 for Medium and 13 to 25 for High. The table is deliberate about one thing: the highest-scoring item is not the most frequent filing. It is the third-party exposure that nobody in the company controls directly. That ordering is exactly what a calendar-driven approach misses.
Write the scale definitions down so two people score the same risk the same way. A workable version for likelihood: 1 means the control is automated and tested, 3 means a control exists but depends on one person, 5 means there is no control or the failure has already happened in the last year. For impact: 1 means an internal correction with no external consequence, 3 means interest or damages and a notice, 5 means prosecution exposure, a licence suspension, a halt to operations or a visible problem in due diligence.
Score before controls (inherent risk) and again after (residual risk). The gap between the two is the proof that your controls do something. If the residual score is the same as the inherent score, the control is decoration.
Step 3: Assign a Named Risk Owner
Every High and Medium risk needs one named owner who answers for it. Not a department, not a committee. If ownership is blurry, the risk is simply unmanaged. We cover how to assign Responsible, Accountable, Consulted and Informed roles task by task in Compliance Management: Roles, RACI and a Monthly Operating Rhythm. The risk register and the RACI matrix should reference each other: every register row has an Accountable name that matches the RACI.
Step 4: Put Controls Between the Risk and the Penalty
A control is anything that reduces likelihood or limits impact. Sort them into three kinds so you can see what you are missing:
- Preventive controls stop the failure: a maker-checker review where one person prepares a return and a second approves it before a Digital Signature Certificate is applied; payroll data locked three to four working days before the EPF due date.
- Detective controls catch a failure early: tiered alerts at 7, 3 and 1 days before a due date; a monthly check that every active contractor has submitted EPF and ESIC proof.
- Corrective controls limit damage after a failure: a documented notice response procedure with an evidence checklist, so a reply is drafted in hours rather than days.
Most companies are heavy on corrective effort (firefighting a notice) and light on preventive and detective controls. For third-party risk specifically, the control that matters is monthly verification, with a record that you checked. The mechanics are in Vendor & Contractor Compliance: Managing Principal Employer Liability.
Step 5: Monitor With Risk Indicators
A control that is never measured decays silently. Key risk indicators (KRIs) are a short set of numbers that move before a failure does. Useful ones for Indian statutory compliance:
- Percentage of filings submitted at least two days before the due date
- Days remaining on the nearest licence or registration renewal, per location
- Number of active contractors with proof overdue by more than 30 days
- Open statutory notices and days since each was received
- Registers pending checker approval for more than 5 working days
Set a threshold for each and decide in advance what happens when it is crossed. A KRI without a trigger action is just a chart. Iztty’s Compliance Score Meter rolls indicators like these into a single 0 to 100 score with act-wise and state-wise breakdown and Low, Medium and High banding.
8. Step 6: Report Upward in One Page
Leadership does not need 150 rows. It needs one page each month: the overall score and its trend, the top five risks by residual score, any KRI over threshold, open notices, and decisions needed. A CFO reads this for penalty exposure, a CEO for whether anything threatens operations or a transaction, and a Company Secretary for audit trail defensibility.
Keep the same layout every month so a change is visible at a glance. Also decide your risk appetite explicitly: for instance, zero tolerance for lapsed licences and contractor proof gaps, with a small tolerance for one-day internal deadline slips.
Four mistakes make frameworks fail in practice. The register is built once and never re-scored, so it describes last year’s company. Scores are set by the person who owns the risk, who has every reason to mark it low. Indicators are tracked but no action is tied to a threshold. And the framework lives in a spreadsheet owned by one person, which recreates the single point of failure it was meant to remove. Have the second line challenge scores each quarter and keep the register in a system with an edit history.
Three Lines of Defence for a Mid-Size Company
The three-lines model sounds like a bank concept, but it maps cleanly onto an Indian employer:
- First line: the people who do the work and own the controls, such as payroll executives, plant HR and factory admin, vendor coordinators.
- Second line: the Compliance Manager or Company Secretary who sets the framework, reviews the register, challenges scores and watches the indicators.
- Third line: independent assurance, such as an internal auditor or an external compliance review that tests whether the first two lines work as described.
In a smaller company one person may hold both first and second line roles. That is the point at which independent review matters most, because nobody is checking the checker. Our guidance on in-house, outsourced and hybrid compliance staffing covers who can fill the third line when you cannot afford a dedicated function.
A Worked Example: A Multi-Factory Manufacturer
Iztty’s published, anonymised outcome for a 14-factory manufacturer is useful as an illustration of the loop working. The company’s compliance score moved from 61% to 88% in 90 days. The pattern behind a move like that is rarely mysterious: the register exposed which factories carried the most licence and register risk, owners were named, maker-checker review replaced single-person filing, and indicators showed which sites were slipping before a deadline passed.
This is an anonymised representative outcome, not an attributed case study, and results depend on starting position.
The lesson for your own framework is the sequence. Rank first, assign second, control third, measure fourth. Companies that start by buying a tool before ranking their risks tend to automate their existing blind spots.
Where a Platform Fits in the Framework
A framework needs data it cannot get from memory. Iztty maps to each step: the obligation register is built from your acts, states and locations; the Compliance Score Meter gives the scored, banded view; the maker-checker-DSC workflow is the preventive control with an audit trail; vendor compliance audits and auto-calculated vendor scores cover third-party risk; and Regulatory Change Intelligence monitors gazette notifications and EPFO and ESIC circulars, turning them into action tasks matched to your company profile, with human review before enforcement.
The AI Notice Response Assistant is the corrective control: it reads a notice, extracts allegations and deadlines and drafts a reply with an evidence checklist, averaging 4 hours against 3 to 5 days manually. For a side-by-side look at tool categories, see Compliance Management Solutions.
Getting Started This Month
- List every act, form and licence by location into a register (aim for a first draft in a week, not a perfect one).
- Score each row for likelihood and impact, before controls.
- Name an owner for every High and Medium row and match it to your RACI.
- Pick five indicators with thresholds and a trigger action each.
- Build the one-page monthly report and review it at the same meeting every month.
- Re-score after any change: a new state, a new contractor, a licence renewal, or a Labour Codes rule notification.
If you would rather start from a pre-built register mapped to your states and acts, book a free compliance audit with Iztty. It produces a scored baseline you can use as the first version of this framework.
FAQs
What is compliance risk management?
It is the ongoing process of identifying legal obligations, scoring the likelihood and impact of failing each one, assigning owners, applying controls and monitoring indicators, so effort goes to the biggest exposures first.
How is compliance risk management different from compliance management?
Compliance management is doing the work: filings, registers, renewals. Compliance risk management decides which of that work carries the most exposure and checks whether the controls around it actually hold.
What are the main compliance risks for an Indian employer?
Late or wrong filings under EPF, ESIC, Professional Tax and Labour Welfare Fund; lapsed licences and registrations; missing or outdated registers; contractor non-compliance that falls back on the principal employer under the CLRA; and regulatory change such as the Labour Codes.
How do I score a compliance risk?
Rate likelihood from 1 to 5 and impact from 1 to 5, then multiply. Score before controls and after to show what your controls achieve. Calibrate the bands to your own size and tolerance.
What is a compliance risk register?
A structured list with one row per obligation per location, recording the act, filing, due date, authority, owner, scores and controls. It is the single source for ranking and reporting.
How often should a compliance risk assessment be refreshed?
Review the top risks and indicators monthly, re-score the full register at least annually, and re-score immediately after a trigger such as a new location, a first contractor engagement or a notified rule change.
Who should own compliance risk in a company?
Each risk needs one named owner. Overall framework ownership usually sits with the Compliance Manager or Company Secretary, with the CFO or CHRO accountable for leadership reporting.
What are key risk indicators for statutory compliance?
Examples include the share of filings made two days early, days to the nearest licence expiry, contractors with proof overdue, open notices and registers awaiting approval. Each needs a threshold and a defined response.
Do the Labour Codes change compliance risk?
Yes. All four Labour Codes took effect on 21 November 2025, with detailed Central and State rules still being finalised, so regulatory change risk is elevated and should be tracked as its own register category.
Can software run a compliance risk framework?
Software supplies the register, scoring, alerts, review workflow and audit trail, which are hard to sustain manually across states. The decisions about risk appetite, ownership and what to do about a High risk remain human.
