Risk management
Navigating through uncertainty
Risk management has a role to play in minimising the impact of events that can have a detrimental effect on the organization. LTIMindtree achieves this by anchoring risk management in day-to-day decisions across various functions and building a risk aware culture to balance risks and opportunities.

Risks and opportunities are constantly assessed to ensure that the business strategy is aligned to the internal and external environment. LTIMindtree’s robust risk-management framework enables a culture of informed and responsible risk taking through systematic and proactive identification of risks, assessment, treatment, monitoring and reporting. Strong oversight is established for the entire risk management program by the Board and senior management.

Enterprise Risk Management (ERM)

The objective of Enterprise Risk Management is to holistically address the risks to the organization, maintaining business growth and profitability through robust governance and strategies. The ERM framework draws a strong Risk Governance structure to shape organization risk management strategy and achieve key business objectives, providing insights on the key risks for the organization. This enables risk informed decisions at the Board and executive management levels. The governance forums at various layers ensures risks are identified, reviewed, and managed across the organization. The Chief Risk Officer is the sponsor for Risk Management activities and is assisted by the ERM team.

Risk Management Committee (RMC)

Risk Management Committee (RMC) is an apex body comprising of the Board Committee and has a focused agenda of overseeing Key Organization Risks. The forum discusses and deliberates on external risks / disruptive trends and its mitigation plans. Emerging risks in context to organization vision in next few years is also discussed. RMC is convened on a quarterly basis.

Audit Committee (AC)

Audit Committee (AC) is a Board Committee with focused agenda on risks and internal controls. AC meetings are conducted on a quarterly basis.

Risk Operating Committee (ROC)

Risk Operating Committee (ROC) comprises CXO's and senior leadership. ROC meeting is conducted twice in a quarter, where risks perceived to the organization are discussed and deliberated, including Enterprise level risks, Data Privacy risks, Cyber Security risks, Business Continuity risks, risk emanating from internal audit observations and any other risk as applicable.

Business Unit (BU) ERM Cadence Meeting

Business Unit level risks are discussed in the monthly cadence meeting. The meeting is convened by the Business Unit Risk Champion and is attended by the Business Unit Head and other Senior Leadership.

The ERM framework implements management of risks at various layers of the organization including risks at project level, account level, business unit level and enterprise level. Detailed risk management process helps to identify and treat the risks before it surfaces as an issue. The process is enabled through a digital platform that provides an enterprise-wide view of risks, enabling informed decision making.

Organization level risks and their treatment

Risk

Risk treatment approach

Capitals impacted

Risk

Resource retention

Challenges in retaining top talent and talent with niche skills. Increased attrition can cause a hit on overall cost of operations as well as goodwill.

Risk treatment approach

  • Structured retention programs at organization and individual business unit level
  • Competitive compensation grid for niche skills
  • Manager excellence through M-Power, manager enablement sessions

Capitals impacted

Risk

Resource fulfilment

Fulfilling demand with shorter lead time results into higher cost of resources impacting profitability. Delayed fulfilment can result in loss of revenue.

Risk treatment approach

  • Demand forecast to be provided by business to plan the supply proactively
  • Leverage Hire-Train-Deploy model for high volume and new age skills demand
  • Reskilling / upskilling of employees

Capitals impacted

Risk

Risk in operating model
Back to office

Business dynamics are changing rapidly in context to flexible working model, remote working and change in workplace design. These drivers will require changes in our operating model balancing the needs of clients / employees.

Operating in the new model will come with its own set of risks like information security for remote operations and employee engagement related concerns.

Operating in the new model will come with its own set of risks like information security for remote operations and employee engagement related concerns.

Localization

Reduced availability of work visas or stringent eligibility criteria or costs could lead to project delays and increased costs.

Risk treatment approach

Back to office

  • Various programs have been initiated to make the organization ready to the changing business dynamics and hybrid work model
Employee communication and training
  • Employee communication and change management is an ongoing process
System, process, and policy readiness
  • Relevant policies are revised to suite the changing business and work model. Systems and processes are in place

Localization

  • Reduction in dependency on work visas through increased hiring of local talent.
  • Reskilling / upskilling of employees at on- shore locations to effectively contain additional sourcing demand

Capitals impacted

Risk

Cyber security

Lack of appropriate controls in cyber security may open vulnerabilities leading to

  • Unauthorized access and cyber attacks
  • Non-Compliance to contractual obligations
  • Critical business data loss
  • Embargo and reputational damage

Risk treatment approach

  • Embrace cybersecurity in the Enterprise Risk Management framework
  • A cyber security strategy along with enterprise security controls across assets – Endpoints, Servers, Clouds, and Infrastructure
  • Resilience planning such as data backup, capacity planning, retainers for services and proactive drills and assessments
  • Patching of vulnerabilities and deployment of security patches across enterprise systems
  • Mandatory trainings and adequate awareness measures across employee life cycle

Capitals impacted

Risk

Data privacy

Non-compliance to privacy laws can attract heavy financial penalties including loss of reputation.

Risk treatment approach

  • A comprehensive global data privacy framework aligned with ISO27701 has been deployed
  • External consultancy for detailed assessments of various functions and improvisation of policies and procedures

Capitals impacted

Risk

Operational resiliency

Organization’s lapse in Business Continuity Management System (BCMS) capabilities can put resiliency of operations in peril and in turn can put customer deliverables at risk.

Risk treatment approach

  • BCMS ISO 22301 certification completed
  • Regular connect with business continuity touch points to ensure compliance at ground level
  • Monthly reporting to Account/BU/BEU leadership team

Capitals impacted

Risk

Foreign exchange

With majority of the business being export driven, the company is exposed to foreign exchange risk.

Risk treatment approach

  • The organization has an approved Financial Risk Management Policy, which provides a framework for managing the foreign exchange risk emanating out of the business. The policy enables implementing a layered hedging program at the Company level.

Capitals impacted

Risk

International mobility

Risk of legal liabilities and reputational loss due to non-compliances to

  • Client documentation processes
  • Country specific wage regulations
  • Work location as against the petition

Risk treatment approach

Implement tool-based control to introduce stringent controls on

  • Client documents and its accountability
  • Payment of wages per local regulations
  • Work location change / intercity movement request as against the employee work location

Capitals impacted

Risk

Regulatory compliances

Non-compliances towards changing regulations across multiple jurisdictions could result in penalties, business loss, debarment, reputational damage, and criminal prosecution.

Risk treatment approach

Following mitigation measures are implemented to ensure compliances on regulations:

  • Implementation of compliance monitoring system to effectively monitor the compliances across various jurisdictions globally
  • Constitution of Internal Compliance Committee for governance on compliances globally
  • Engagement with external consultancy firms for timely updation of the Compliance Obligation Registers in line with changing laws

Capitals impacted

Risk

ESG

ESG and its associated risks / opportunities are becoming more and more relevant, with heightened demand from investors, customers and increasing pressure from regulatory bodies. Non-compliance to the same can impact the brand image of the organization.

Risk treatment approach

Environment

  • Target to become carbon and water neutral for India operations by 2030. Initiatives include ‘energy consumption optimization, increase green energy, reduce water consumption, green buildings, etc.

Social

  • CSR projects on Women Empowerment and Persons with Disabilities (PwD) by skilling, employing, educating, providing market linkages support as well as enabling beneficiaries for micro entrepreneurship

Governance

  • Transparent reporting feeding into Annual Reports
  • Governance on the required regulations including Payroll and Social Security law, Employee Health and Safety, Financial Reporting, Bribery and Corruption

Capitals impacted

Risk

Execution

Impact of new normal style of working on critical deliveries and milestones.

Risk treatment approach

  • All delivery parameters are reviewed and monitored through digitized governance process
  • High risks projects are monitored by Leadership through regular review processes

Capitals impacted

Risk

Integration

Integration of two erstwhile entities into LTIMindtree can bring its own risks, broadly from the following spaces:

Risk treatment approach

Integration of two entities is a complex process and a framework has been built around the number of activities and processes that need to be harmonized.

  • A detailed integration plan has been created to identify risks and ensure appropriate treatment across multiple tracks
  • Multiple communication channels have been used to communicate merger benefits and synergies to all stakeholders
  • All regulatory approvals have been obtained on time

The LTIMindtree Integration Management Office is tracking the risks and working with identified track owners to monitor treatment plans. Detailed reports are being provided to executive management and the Board.

Capitals impacted

Risk

Macroeconomic and geopolitical

Geopolitical disruptions such as the Russia- Ukraine conflict and resultant volatility in the global economy may adversely affect the outlook, cause inflation. This in turn can result in reduced revenue growth opportunities that can impact client spend as well increased cost of doing business.

Risk treatment approach

  • Geopolitical developments like trade wars, sanctions, export controls and border conflicts which may impact supply chains, lead to loss of new opportunities, and harm the IT sector’s global business environment are monitored closely
  • Macro-economic parameters, such as GDP growth, interest rate and inflation, are tracked to identify uncertainties in economic conditions which may impact the countries in which LTIMindtree operates
  • A diversified revenue mix across different geographies and domains helps to mitigate this risk

Capitals impacted

Risk

Revenue concentration with top clients

A big chunk of our revenue is from few of our major customers. IT spend budget/strategy of these customers as well as relations with them can have great bearing on our top-line as well as bottom-line

Risk treatment approach

  • Given the increased size of LTIMindtree post integration, business concentration with top customers has reduced. LTIMindtree is diversifying the revenue profile by targeting the next set of customers. Focused efforts are being made to ensure growth of the next set of top clients. Detailed monitoring of deliverables by senior management has led to very good client satisfaction scores. A high level of executive connect has ensured very healthy relationship levels with client leadership

Capitals impacted

Risk

Pandemic outbreak

The Company’s operations could be adversely affected due to impact of the pandemic on employee’s health and safety

Risk treatment approach

Various programs have been implemented in the organization to maintain employee health and safety which helped to combat the situation, specially in earlier part of this year.

  • Vaccination drives for employee safety
  • 24x7 emergency medical helpline
  • Establishment of Covid-19 emergency response cell

Capitals impacted