Stakeholders Relationship Committee & Risk Management Committee: The Two Board Committees That Can Delay Your IPO (2026)

By CS Sapna Malpani, Practising Company Secretary, Bangalore | Last updated 22 July 2026

In 2025 the National Stock Exchange sent penalty notices to roughly 250 listed companies for Listing Obligations and Disclosure Requirements lapses, and a recurring line item on those notices was a board committee that was either not constituted or wrongly composed. Under the SEBI Standard Operating Procedure the meter runs at Rs 2,000 a day until the entity fixes it. For an unlisted public company that crosses one thousand security holders, the parallel failure carries a fixed Rs 5 lakh penalty on the company and Rs 1 lakh on every officer in default under Section 178(8). Most founders preparing to list have sorted out the Audit Committee and the Nomination and Remuneration Committee. The two that get left to the last week before the DRHP are the Stakeholders Relationship Committee (Regulation 20 read with Section 178(5)) and the Risk Management Committee (Regulation 21).

The problem: two committees that are neither Audit nor NRC

When a private company converts to public and heads towards a listing, its board committee obligations multiply. The Audit Committee under Section 177 and Regulation 18, and the Nomination and Remuneration Committee under Section 178(1) to (4) and Regulation 19, get the attention because their names come up first and their roles feel familiar. I covered both, and the Rs 39 lakh composition mistake that follows from getting them wrong, in an earlier guide on Audit Committee and NRC composition.

The Stakeholders Relationship Committee and the Risk Management Committee sit in the same Section 178 and the same LODR chapter, yet they run on different triggers, different composition rules and different meeting rhythms. A company can have a textbook Audit Committee and still fail its secretarial audit because the SRC chair is an executive director, or because the RMC was never constituted even though the company sits inside the top 1000 by market capitalisation. These are exactly the findings that surface in a Section 204 secretarial audit report and that a book-running lead manager flags during pre-issue due diligence. A qualified secretarial audit report is not the note you want a merchant banker reading three weeks before your DRHP goes in.

Diagram 1: The four board committees at a glance

Here is where the Stakeholders Relationship Committee and the Risk Management Committee sit relative to the two committees most companies already have.

Composition figures for the Audit Committee and NRC are summarised here for context; the two committees this guide focuses on are the SRC and the RMC.

Stakeholders Relationship Committee: the grievance committee with a non-executive chair rule

Regulation 20 requires every listed entity to constitute a Stakeholders Relationship Committee to look into the redressal of grievances of shareholders, debenture holders and other security holders. The composition rule is the one companies trip on: at least three directors, with at least one being an independent director, and the chairperson must be a non-executive director. If a listed entity has outstanding superior voting rights (SR) equity shares, at least two-thirds of the committee must be independent directors. The committee must meet at least once a year, and its chairperson has to be present at the annual general meeting to answer security holders’ questions directly.

The Companies Act sets its own, wider trigger. Section 178(5) says the board of a company with more than one thousand shareholders, debenture holders, deposit holders and any other security holders at any time during a financial year must constitute an SRC with a chairperson who is a non-executive director. This catches unlisted public companies that have raised money from a large base (a rights issue, an NCD programme or a deposit scheme) long before any listing. The role, under Section 178(6), is to consider and resolve the grievances of security holders: transfer and transmission of shares, non-receipt of the annual report, non-receipt of declared dividends, issue of duplicate certificates, and the reduction of unclaimed dividends.

There is one sensible carve-out. The proviso to Section 178(8) states that non-consideration of a grievance by the SRC in good faith does not, by itself, amount to a contravention. The committee is judged on whether it exists and functions in good faith, not on whether it resolves every complaint to the complainant’s satisfaction. Section 178 also does not apply to Section 8 companies (that are not in default) or to specified IFSC public companies.

Risk Management Committee: the top-1000 committee founders assume they are too small for

Regulation 21 requires the board to constitute a Risk Management Committee with a minimum of three members, the majority of whom are members of the board, including at least one independent director. Where the entity has outstanding SR equity shares, at least two-thirds of the RMC must be independent directors. The chairperson has to be a board member, though senior executives of the company may sit on the committee. The RMC must meet at least twice a year, and no more than 180 days may pass between two consecutive meetings. Quorum is two members or one-third of the committee, whichever is higher, with at least one board member present.

Applicability is the part that surprises people. Regulation 21 applies to the top 1000 listed entities determined by market capitalisation as at the end of the immediately preceding financial year, and to high value debt listed entities. When the rule first came in it applied only to the top 100, then the top 500; the Second Amendment of 2021 (notified 5 May 2021) widened it to the top 1000. A company that lists at a healthy valuation can find itself inside the top 1000 in its first year and inside Regulation 21 from that point, so the RMC is a going-concern obligation for a newly listed company, not a large-cap luxury.

The committee’s job is spelt out in Part D of Schedule II. It must formulate a risk management policy covering financial, operational, sectoral, sustainability (including ESG), information and cyber security risks, along with mitigation measures and a business continuity plan. That policy has to be reviewed at least once every two years. Where a company appoints a Chief Risk Officer, that appointment, removal and remuneration are subject to the RMC’s review.

What non-compliance actually costs

There are two enforcement tracks, and an IPO-bound company can be exposed to both in sequence: the Companies Act penalty while it is an unlisted public company, and the SEBI SOP once it lists.

The SEBI SOP fine looks small until you count the days. A committee that should have been constituted at the start of the financial year but is fixed only after the annual secretarial audit flags it, say 210 days later, attracts a fine of over Rs 4 lakh before a single show-cause reply is drafted, and the promoter shareholding freeze is the part that actually changes behaviour, because a frozen promoter block stalls pledges, transfers and follow-on plans.

Diagram 2: Getting both committees in place before you file

What you must do now

A short, ordered checklist for a board and its company secretary preparing either for a large security holder base or for a listing.

1. Count your security holders across the whole year. Section 178(5) is triggered by more than 1,000 holders at any time during a financial year, not on the last day. A rights issue or NCD allotment that briefly pushed you past 1,000 counts.
2. Check your market-cap rank if listed. Regulation 21 keys off the top 1000 by market capitalisation at the end of the previous financial year. If you are close to the line, assume you are in and constitute the RMC.
3. Put a non-executive director in the SRC chair. This is the single most common defect. An executive or managing director chairing the SRC is a straight Regulation 20 and Section 178(5) breach.
4. Place at least one independent director on each committee. For a listed SRC, at least one independent director; for the RMC, majority board members with at least one independent director. Where SR equity shares exist, two-thirds must be independent.
5. Adopt written terms of reference. Mirror Part D of Schedule II for both committees, and the risk policy must expressly cover ESG and cyber security risks and a business continuity plan.
6. Diarise the cadence. SRC at least annually; RMC at least twice a year with no more than 180 days between meetings. Set the calendar for the year and hold to it.
7. Have the SRC chair attend the AGM. Regulation 20 and Section 178(7) require the chair to be present to answer security holders. Record the attendance in the minutes.
8. Review the risk policy every two years. Put the review date in the compliance calendar so it is not missed in year three.
9. Reconcile against your secretarial audit. Ask your Section 204 auditor to confirm both committees pass on composition, quorum and cadence before the DRHP is drafted.

The deeper implication

According to CS Sapna Malpani, the pattern she sees in pre-IPO reviews is not companies ignoring committees, it is companies treating all committees as one task and copying the Audit Committee composition onto the others. The SRC and RMC have deliberately different rules. The non-executive chair on the SRC exists so grievance handling is not controlled by the same executives whose conduct might be complained about, and the board-heavy RMC exists so risk oversight is not delegated wholesale to management. Copy-pasting the Audit Committee template onto them defeats both purposes and produces a technically constituted but non-compliant committee.

The direction of travel is towards more, not fewer, committee obligations. SEBI has already widened Regulation 21 from the top 100 to the top 1000 and has been layering ESG and cyber risk into the RMC’s mandate. A company that builds a genuine committee track record a year before filing, rather than constituting on paper in the DRHP fortnight, will clear due diligence faster and carry a cleaner secretarial audit into the issue.

Comparison with related provisions

Three points of confusion are worth settling. First, the Audit Committee and NRC live in Section 177 and Section 178(1) to (4); the SRC lives in Section 178(5) to (7). Same section number, different sub-sections and different rules, do not assume that constituting an NRC discharges your SRC obligation. Second, the RMC is a creature of SEBI LODR (Regulation 21) and, unlike the SRC, has no direct Companies Act penalty; its enforcement runs entirely through the SEBI SOP and the stock exchange. Third, the SRC’s Companies Act trigger (Section 178(5), more than 1,000 security holders) reaches unlisted public companies that the LODR never touches, which is why a large private-to-public company can owe an SRC well before it owes anything under Regulation 20.

Sources and references

• SEBI LODR Regulation 21, Risk Management Committee (bare regulation, CAIRR)
• SEBI LODR Regulation 20, Stakeholders Relationship Committee (bare regulation, CAIRR)
• Section 178, Companies Act 2013, NRC and Stakeholders Relationship Committee (CAIRR)
• Securities and Exchange Board of India, LODR Regulations and Master Circular on non-compliance
• AZB & Partners, Revised fines and SOP for non-compliance with SEBI LODR
• TaxGuru, Committees under SEBI (LODR) Regulations, 2015 and amendments