Risk Management Framework

Fund management, compliance and operations can all create risk for a mutual fund scheme. None of them should mark its own homework.

SEBI's Risk Management Framework, or RMF, fixes that. It makes every Asset Management Company run risk management as its own job, with its own staff. That risk team stays apart from the teams it watches. So a problem in fund management gets flagged by someone who does not report to the fund manager.

Under the RMF, an AMC must strengthen accountability by designating dedicated risk officers for each of four named areas of exposure:

1. Investment risk
2. Compliance risk
3. Operational risk
4. Cyber security

The framework sits within the AMC's wider organisational structure, alongside — but functionally independent of — fund management, the compliance function, and the operations and customer services team. Because risk management is carved out as its own specialised function rather than folded into, say, the fund management team's own self-assessment, a risk officer covering investment risk is positioned to flag a concentration or a limit breach without that assessment being filtered through the very team that took the position.

Illustrative. Devbhoomi Asset Management Company runs a debt scheme, Devbhoomi Corporate Bond Fund, with net assets of Rs 3,000 crore. The scheme holds Additional Tier 1 (AT1) bonds of one private bank, bought when the fund manager's desk found the yield attractive.

SEBI's exposure limits on AT1 and Tier 2 bonds — the kind of ceiling an investment risk officer is there to watch, independently of the fund manager who built the position — are:

The fund manager's desk wants to add Rs 40 crore more of the same bank's AT1 bonds, taking the single-issuer holding to Rs 170 crore — 5.67% of scheme assets, over the Rs 150 crore ceiling.

Because the investment risk officer sits outside fund management, the breach is flagged to the trustees before the trade is placed, not discovered afterwards in a compliance review. The order is cut back to Rs 10 crore, keeping the issuer exposure at exactly Rs 150 crore — the 5% line.

Chapter 3, section 3.3.3, introduced immediately after the description of the RTA, custody and fund accounting teams within an AMC's operations and customer services structure. Expect a recall question on the four named areas of risk (investment, compliance, operational, cyber security) and on the framework's core requirement — an independent and specialised risk function with dedicated risk officers.

• Four named areas: investment, compliance, operational, cyber security — a candidate who names only two or three from memory is missing part of the list.
• The RMF's defining feature is independence — risk management sits apart from fund management and other operating teams, not embedded inside them.
• Do not confuse the AMC-level Risk Management Framework with the scheme-level Potential Risk Class matrix, which classifies individual debt scheme risk rather than governing the AMC's internal risk function.