Risk management
We fortify the future by proactively
minimising risks

With a robust Enterprise Risk Management process in place, we continuously assess and improve our mitigation measures with respect to industry dynamics and emerging trends.

Risk governance and management

Our fully automated Online Risk Management System, the RMS 2.0, monitors the risk management requirements and assesses the duration of a risk posture impacting us, at a rapid pace with its effectively functioning Risk Velocity concept. With smart dashboards showcasing business cluster-wise results, we have effectively enabled real time management reporting. The system helps us in determining the Risk Mitigation Completion Index (RMCI) that measures the completion of mitigation actions against target dates.

Risks are identified across sector specific, technology, regulatory, commercial, financial, business, climate change, business continuity parameters and project risks
We designate a risk owner and champion responsible for structuring mitigation plans against identified risks
The outcomes of the first two stages are collectively mapped into our internal system with designated responsibilities and timelines to achieve riskrelated targets
Our risk management system enables Cluster Risk Management Committees (CRMCs) to ensure seamless monitoring and review of current and future risk plans
A Risk Mitigation Completion Index (RMCI) is employed to determine and monitor the level of completion of mitigation actions
When the RMCI percentage is lower than the target, the deviation in mitigation action areas is reviewed for requisite intervention
Insights from the risk mitigation process are further incorporated in the risk plan to enable
cross-functional learning across the organisation and enable efficacious risk management
Our risk register lays out concise and complete details of our identified risks and mitigation plans

Risk compliance

Our risk management approach monitors our compliance status through our proprietary Compliance Management System (CMS) software. The software covers Tata Power and all material domestic subsidiaries. The software updates the database with changing laws/regulations ensuring automated deletion of legislations that are not relevant anymore. We ensure effective governance and create quarterly regulatory compliance status reports
to the Board.

We have integrated our Internal Financial Controls (IFC) into our Risk Control Matrix (RCM) to meet the requirements of the Companies Act, 2013. We also employ Control Self-Assessment (CSA) to assess the effectiveness of internal controls at each process level. The responses of all process owners support CEO/CFO certifications for internal controls.

Key risks and their mitigation

Details of our identified risks, mitigation strategy and linkage to our strategic business objectives are provided below.

Sector-specific risk

RISK

  • Creditworthiness and business continuity of the customers

MITIGATION ACTIONS

  • Sustained advocacy with authorities
  • Diversification of renewable portfolio across various procurers, tariff structures and states

Technology risk

RISK

  • Cybersecurity risk having the potential to impede operational transactions
  • Information security - loss /misuse of vital data (operational and customer), cyber-attacks affecting LAN, WAN, SCADA, DMS, etc.

MITIGATION ACTIONS

  • Automated detection and preventive solutions with managed detection and response
  • Secure access to internet and applications on need-to-know basis
  • Reinforcement of security policies and procedures
  • Secure Source Code review before every release of application
  • Enterprise-wide training and awareness programmes on information security
  • Vulnerability Management Programme to proactively detect vulnerabilities
  • Inputs from Computer Emergency Response Team (CERT) and other private cyber intelligence agencies
  • Periodic testing to validate effectiveness of controls through vulnerability assessment and penetration testing
  • Regular internal and external audits
  • Investment in cyber insurance
  • ISO 27001 certification for Digitalisation & Information Technology (D&IT), critical infrastructure and renewables
  • Three cycles of phishing simulation exercise carried out followed by e-learning module on the same to increase awareness
  • Introduced e-learning module on Information system management system (ISMS)
  • Implementation of Security Operations Centre (SOC) as service
  • Access list configurations and authentication bases access
  • Replacement of existing systems with improvised secure solutions for SCADA, firewalls

Regulatory risk

RISK

  • Amount Recoverable through future tariff (Regulatory Overhang/ Regulatory Assets)
  • Mundra coal under-recovery
  • Water securitisation of hydro plants: Risk of reduced generation
  • Risk of violating environment norms

MITIGATION ACTIONS

  • Advocacy with Mundra Power procurers and government at various levels
  • Blending of cheaper coal from different geographies
  • Advocacy with Ministry and regulatory bodies at various levels
  • New avenues to utilise fly ash in ready mix concrete, slag cement, fertiliser among others for 100% ash utilisation
  • Implementation of flue gas desulphurisation plant (FGD) and NOx abatement system (De-NOx)
  • Appeal in Appellate Tribunal / High courts

Commercial risk

RISK

  • Revenue Loss due to migration of high-end consumers on account of higher tariff
  • Receivables from rooftop channel partners

MITIGATION ACTIONS

  • Advocacy with MERC and filing petitions on CSS correction, revision of wheeling charges and new MYT petition
  • Check on the wheeling impact of capex for distribution projects
  • Rigorous contact plan of key consumers and extending value added services
  • Instituted a credit policy with multi-level approval mechanism

Financial risk

RISK

  • Risk of Capex Disallowance in T&D
  • Availability of cost- effective capital: Availability of debt
  • Forex risk
  • Renewal of operating license of investments

MITIGATION ACTIONS

  • Advocacy with State Transmission Utility (STU)/ regulator for acceptance of schemes through costbenefit analysis
  • System controls for monitoring consumption and linkages of approved DPRs
  • Diversification of lenders base
  • Hedging of foreign currency exposures
  • KPC received Izin Usaha Pertambangan Khusus (IUPK) i.e. Special Mining Business Permits (extension of Coal Contract of Work) being valid
    for 10 years upto 2031

Business risk

RISK

  • Availability of fuel for thermal plant at optimal cost
  • Natural disasters like cyclones, flood, drought, storm, earthquake, and lighting

MITIGATION ACTIONS

  • Exploration of alternate coal sources and sourcing coal from multiple suppliers
  • Formulation of Disaster Management Plan
  • Resource and material planning

Climate change, water, and Business Continuity Plan (BCP)

RISK

  • Climate change linked transitional risk:
    • Possibility of capping of carbon emissions
  • Climate change linked physical risks:
    • For operations located in coastal area
    • Rise in water temperature potentially affecting processes
    • Extreme weather events such as floods and droughts, fuel, and water scarcity
  • Risk of pandemic and other natural disasters

MITIGATION ACTIONS

  • Comprehensive, digitised GHG tracking through ESG platform and adoption of Science Based Targets
  • SBTi- Targets – validated
  • Lowering of carbon intensity by focusing more on the renewable portfolio as well as venturing into energy efficient businesses like
    rooftop solar, EV charging, microgrids, etc.
  • Increase of RE Portfolio strength
  • Improvement in operational efficiency for thermal power plants
  • Installation of pollution control and energy efficient equipment
  • Discharge water temperature monitoring at Mundra and Trombay stations
  • Adherence to stringent design parameters (to address climate risks) while developing new projects
    • Protection measures against extreme weather, flooding, etc.
    • All new projects will address climate change in equipment specifications to withstand extreme weather
    • Design changes/upgrades to accommodate higher operating temperature ranges
  • Establishment of robust Business Continuity and Disaster Management Plan (BCDMP) evidenced through recertification on ISO 22301:2012 from the British Standards Institute (BSI)

Project risk

RISK

  • Change in land / site due to unavailability of site or due to unavailability of transmission connectivity post winning a bid or contract
  • Project execution timelines exceeding internal / Scheduled Commercial Operation Date (SCOD) target dates

MITIGATION ACTIONS

  • Evaluate multiple sites / land parcels at time of bidding and creation of land and connectivity bank
  • Consideration of a particular site for bidding once connectivity has been secured / applied on BG route and land identified, surveyed and firm offers available
  • Explore procurement of Government land on lease
  • Greater comfort on land and connectivity through timely identification, securitisation, and acquisition in line with the pre-bidden timelines
  • Tight project monitoring and control from pre bid to post bid and till SCOD
  • Dedicated project management teams for larger complex projects
Financial
Intellectual
Manufactured
Social and Relationship
Human
Natural