The Founder Belongs on the Risk Register

Why the entry goes unwritten

A company's risk register usually covers the plant, the bank covenants, the servers and the largest customers. It can easily leave out the person whose name is on the door, although an allegation against that person, a long illness or a public family quarrel can unsettle lenders, staff and customers just as a failure in any of those can.

The entry would have to be approved by its own subject, and nobody wants to be the employee who drafts it. Registers also follow templates. SEBI's listing regulations require the 1,000 largest listed companies to have a risk management committee, and the policy that committee writes must include a framework for identifying financial, operational, sectoral, sustainability, information and cyber security risks, and then 'any other risk' the committee determines [1]. The principal sits in that last clause and is easy to leave there.

Family firms add deference. In PwC's 12th Global Family Business Survey, 52 per cent of Indian family businesses cited resistance from the senior generation as the biggest barrier to next-generation leadership, against 29 per cent globally. The Indian sample was only about 40 leaders, so the figure is indicative [2].

Listed Indian companies are largely promoter-owned. Promoters held 50.2 per cent of NSE-listed companies by market value in June 2026: private Indian promoters held 32.1 per cent, and the government and foreign promoters the rest [3].

How much of a company's standing rests on one person is harder to pin down. In a Weber Shandwick survey of more than 1,700 executives in 19 countries, published in 2015, respondents on average attributed 45 per cent of their company's reputation to the reputation of the chief executive, and estimated that it accounted for 44 per cent of the company's market value [4]. These were opinions, gathered in 2014 from executives at companies with revenues of US$500 million or more, or the regional equivalent. Where the business carries the founder's name we would expect the share to be no lower. That is an inference; the survey release does not break the figures out by ownership.

What the rules already assume

For a listed company, SEBI's listing regulations already treat events in the principal's life as company events.

Not every row reaches every listed company. Regulation 15 exempts companies listed on an SME exchange and, broadly, those with paid-up equity capital of up to ₹10 crore and net worth of up to ₹25 crore from regulation 17. Regulation 30 has no such exemption [1].

The Companies Act, 2013 points the same way. A board's report must include a statement on the company's risk management policy, identifying any risk which in the board's opinion 'may threaten the existence of the company', although the Act allows an abridged report for one person companies and small companies. Where the Act requires whole-time key managerial personnel, the board must fill a vacancy within six months [5]. The Corporate Laws (Amendment) Bill, 2026, which would amend the Act, was introduced in the Lok Sabha on 23 March 2026, and a joint parliamentary committee reported on it on 3 August 2026. The PRS bill tracker showed no vote in either House when this note was written [6], so check the text in force before relying on a section.

The listing regulations do not bind an LLP or a company with no listed securities. Private fund investors ask for something similar by contract. Principles 3.0 of the Institutional Limited Partners Association, published in 2019, say that a key person event should result in an automatic suspension of a fund's investment period, and that investors should be notified immediately when a key person provision is tripped [7].

What the principal file holds

One named person keeps the file, which has five parts.

• The public record, meaning what a stranger can find in an afternoon: news coverage, court and company filings, old interviews, and the social accounts of the principal and close family.
• The known vulnerabilities, written plainly by someone the principal trusts: disputes, former partners, anything from the past that would read badly as a headline. Ask counsel how this part should be held and who may see it.
• The approved biography, short and long, with every line traceable to a document. A line that cannot be proved is an opening for a hostile reader.
• The spokespeople: who speaks when the principal is the subject, and who speaks when the principal cannot be reached.
• The first three calls, with numbers and a deputy for each. Usually these are counsel, the chair or senior family member, and the lender or investor who should not learn of it from the press.

The file is personal data about a living person and often about relatives. Keep it to what is needed, compile it with the knowledge of the principal and of any relative it covers, and limit who can open it.

Deciding how visible to be

A founder usually becomes the face of the company by drift. An interview is given because nobody else was free, or a personal account turns into the company's main channel. Each step moves more of the company's standing onto one person, and nobody decided that it should.

Take the decision once a year and write it down: which subjects the principal speaks on and which belong to the company, which accounts are personal, and who else is being built up as a second credible voice. Low visibility is also a choice with a cost. A principal nobody knows has no goodwill to draw on, and the first detailed account of them may be written by an opponent.

What a board or investor can ask for

A board, lender or investor can ask for the following without prying:

• a line on the risk register, with a review date and an owner who is not the principal;
• confirmation that the file exists and when it was last updated;
• one rehearsal a year of two scenarios, the principal unreachable for a week and the principal named in an allegation;
• a written delegation covering who signs, who speaks and who decides in the principal's absence;
• the principal's undertaking to tell the chair early about any personal matter likely to become public.

A board can reasonably ask whether the file exists, who owns it and when it was last tested. Reading the list of vulnerabilities, or supervising a private life, is beyond that.

ARKA's business advisory desk, The Cabinet, helps a founder or family assemble the file and run the rehearsal. It does not give legal advice, and questions of law or disclosure go to independent advocates and a practising company secretary engaged by the client.

What to do with this

• Add the principal to the risk register, with an owner and a review date.
• Assemble the file and name its keeper.
• Decide the principal's visibility for the year and record it.
• Rehearse both scenarios with the people named for the first three calls.
• If the company is listed, have the company secretary map the rehearsal to the disclosure deadlines.