The Compliance Risk Nobody Scored

1. The Calendar Was Perfect

A packaging manufacturer with about 220 employees ran a tidy compliance calendar. EPF ECR on the 15th, ESIC and Professional Tax right behind it, factory licence renewal flagged 60 days out. Every date was tracked. When a labour department inspector visited, the filings were fine. The problem was a housekeeping contractor whose workers had gone three months without EPF remittance. Nobody had put that on the calendar, because it was not a date. It was an absence.

2. What Was Missing

The company had a list of things to do. It did not have a ranked list of things that could go wrong. Those are different documents. A calendar answers when something is due. A risk register answers what would hurt most if it failed, and who is watching it. Under the Contract Labour (Regulation and Abolition) Act, 1970, the principal employer can carry liability for a contractor's failure, which made this the single biggest exposure in the company. It scored nowhere because nothing was being scored.

3. Ranking Changes Where Attention Goes

Once risks are ranked, the order is often a surprise. The monthly EPF filing, the thing everyone worries about, usually sits mid-table because the process is established and the penalty for a short delay is bounded. A lapsed licence or an unverified contractor sits higher because the likelihood is harder to see and the consequence reaches past money into operations and personal exposure. Ranking moves attention away from the loudest task and toward the largest exposure.

4. The Two Numbers That Do the Work

You need only two ratings per obligation: how likely it is to fail given your current process, and how bad it is if it does. Multiply them. Then do it again after you account for the controls you already have. If the second number is no lower than the first, the control is not doing anything. Writing the scale definitions down, so two people rate the same item the same way, matters more than the precision of the numbers.

5. A Small Start

You do not need a hundred rows on day one. List your registrations and licences, your contractors and the filings that cross into penalty territory if late. Rate them. Name one owner for each of the top ten. Review the list monthly. The full six-step method, including indicators and a one-page leadership report, is in Compliance Risk Management: A Framework for Indian Companies.