Governance almost always lags growth. The setup that was clean at thirty people is quietly exposed at three hundred. Build a proportionate framework now, so the gaps aren’t surfaced for you by a regulator, a DPDP notice, a disgruntled former employee, or a diligence team halfway through a term sheet.
Book a discovery callMost Indian SMEs land in one of two camps. Either nothing is written down and leadership is quietly hoping, or there’s a binder of policies copied from a multinational template that nobody in the building has actually read. Both fail the first serious audit. Both fail the first time something goes wrong.
We build something proportionate. A real risk register drawn from interviews, not a template. Policies written in the language of your business so people can actually follow them. Clear ownership against each control. A review cadence that keeps the whole thing current. The aim isn’t to tick every possible box. It’s to be able to show, honestly, that you know your top risks and you’re managing them.
We aren’t lawyers and we don’t give legal advice. Where a legal opinion is needed, we’ll say so and bring in your counsel. Our job is to translate their requirements into something the operating business can actually sustain on its own.
Six patterns that show up across NBFCs, healthcare, edtech, and data-heavy SMEs. Two or three usually apply.
Policies designed for 30 people don’t hold at 300. Approvals happen over WhatsApp, accountability is fuzzy, audit trails are thin.
New rules came in (GST, data protection, sector-specific) and nobody fully mapped what they mean for the business. There’s quiet exposure nobody has priced.
If asked to list the top ten risks to the business, three leaders would give three different lists. Risk isn’t being managed, it’s being hoped away.
Customer data is held in ad-hoc systems, access is broader than it should be, there’s no clear retention or breach response plan.
Customer and supplier contracts are inconsistent, signed out of view, held in someone’s email. Nobody can answer basic questions about obligations.
An audit or diligence request triggers a two-week scramble. The information exists but it takes a team to pull it together each time.
Typically sixteen to twenty-four weeks. Sector drives what gets scoped in (RBI, DPDP, FSSAI, SEBI); the shape of the engagement stays broadly the same.
We map the regulatory obligations specific to your sector and geography, interview the team, and build the real risk register, not a template.
Against the map, where are you genuinely exposed? We rank gaps by probability and impact and agree the ones worth closing now.
Policies written to be followed, controls designed to be operational, ownership assigned, training delivered. Practical over pretty.
Quarterly risk review, annual policy refresh, defined escalation, built into the existing management rhythm, not layered as a separate bureaucracy.
Governance artefacts your board, your auditor, and your CFO can all use. Proportionate, practical, and sized for the business you run today, not the one the template assumes.
Top risks to the business with likelihood, impact, existing controls, and owner, built from interviews and evidence, not a generic template.
Specific rules that apply to your business today, what they require, who owns each, and the evidence you’d need to show compliance.
An honest list of where you’re exposed, prioritised, with a remediation plan that has owners, deadlines, and realistic effort estimates.
The handful of policies that actually matter, data protection, AML where relevant, code of conduct, whistleblowing, contracts, written in language people can follow.
Who approves what, at what threshold, with what evidence, replacing informal approvals with a framework an auditor can follow.
Quarterly risk review format, annual refresh process, and training sessions so the framework lives with the people who have to run it.
“Our growth had outrun our policies by a long way. Apxe built a proportionate governance framework, not a bureaucratic one, and walked our board through it until it was genuinely their own.”Result: Audit findings down from 14 to 2
Governance theatre helps no one. If policies aren’t going to be enforced, don’t commission them. Read the lists honestly first.
Five questions CFOs, company secretaries, and general counsel raise on every first call. Short answers below.