Authored by Mihir Vora, Director - Corporate Solutions Group, Lockton India

For a long time, risk management in Indian corporates was largely viewed as a functional requirement, often coming into focus after incidents, regulatory developments, or unforeseen losses. The primary emphasis was on compliance, insurance procurement, and claims resolution.

That approach worked when risks were linear and contained. Today, it no longer does.

Indian companies today are dealing with a very different risk landscape. Supply chains that break without warning, weather disruptions that are no longer rare events, growing cyber incidents, and constantly evolving compliance expectations. Add to that the pressure of real-time public scrutiny and investor questions.

That’s exactly why TCOR (Total Cost Of Risk) matters. Not as another dashboard, but as a way to build risk thinking into how decisions actually get made.

1. Start by Redefining Risk Beyond Insurance

The first and most critical shift is conceptual.

Reactive risk management perceives risk as a regulatory deviation or business process deviation or an insurable event. Proactive risk management defines risk as any uncertainty that can materially impact earnings, continuity, or reputation.

TCOR operationalises this shift by expanding the risk lens beyond premiums & usual metrics to include:

· Retained losses and deductibles

· What it costs to run the claims machine (including legal fees)

· The compliance overhead that keeps increasing every year

· Downtime and disruption due to missed dispatches, stalled sites, delayed milestones

· That “nobody budgets for this” bucket consisting of productivity loss, leadership time, and reputational damage

In Indian manufacturing, logistics and infrastructure, disruptions don’t arrive as neat line items. They show up as revenue leakage.

2. Quantify Risk in Business Language, Not Risk Jargon

Proactivity demands credibility in the boardroom.

TCOR enables this by expressing risk as a financial performance indicator, typically measured as TCOR-to-revenue or TCOR-to-operating cost. This allows risk to be evaluated alongside margins, EBITDA, and return on capital.

For example, two business units with identical insurance premiums may have vastly different TCOR profiles due to variations in incident frequency, process inefficiencies, or claims leakage. Once quantified, these differences force sharper conversations around operational discipline and capital allocation.

In India, where boards are increasingly focused on capital efficiency and governance outcomes, TCOR provides a common language between risk, finance, and strategy teams.

3. Use TCOR Benchmarks to Identify What to Fix First

Proactive risk management is not about doing everything at once. It is about prioritisation.

Once TCOR is tracked consistently, it becomes easier to see what’s actually happening beneath the surface. For many Indian organisations, this exercise throws up a clear insight: risk volatility is often self-created. Claims leakage, weak loss-control discipline, and inefficient internal processes end up contributing more to TCOR swings than external disruptions. The difference is — these are fixable.

And that is the real value of TCOR benchmarking. It gives leaders the confidence to move budgets away from passive risk transfer and towards targeted prevention, operational tightening, and smarter design of controls.

4. Shift from Annual Reviews to Continuous Monitoring

Reactive risk functions operate on periodic cycles, and for insurance, it’s once annually. . Proactive ones operate in real time.

TCOR supports continuous monitoring by tracking trends in claims, near-misses, operational losses, and compliance deviations. When layered with analytics, patterns emerge well before losses escalate.

Advanced Indian organisations are now using data analytics and AI-driven tools to flag high-frequency, low-severity events that cumulatively erode profitability. Over time, addressing these patterns can reduce volatility and stabilise cash flows, an outcome far more valuable than marginal premium savings.

5. Align Risk Decisions with Business Strategy

One of TCOR’s most underappreciated strengths is strategic alignment.

Decisions around risk retention, deductibles, and insurance structures should not be standalone risk calls. They should reflect the organisation’s risk appetite, capital strength, and growth priorities.

For instance, a capital-rich Indian conglomerate may choose higher retention to optimise TCOR, while a growth-stage enterprise may prioritise volatility reduction. TCOR provides the data needed to make these choices deliberately, rather than by default.

This alignment transforms risk management from a defensive function into a strategic enabler.

6. Embed Risk Ownership Across the Organisation

No framework works in isolation.

TCOR becomes truly proactive only when risk ownership moves beyond the insurance or risk team. By linking risk costs to business outcomes, TCOR creates accountability at the operational level.

When plant heads, supply-chain leaders, and functional managers understand how their decisions influence the total cost of risk, behaviour changes. Risk awareness becomes embedded in daily decision-making, not enforced through policy documents.

This cultural shift is essential for long-term resilience.

Conclusion: Designing the Risk Function of the Future

Over the next decade, the most consequential risk for Indian enterprises will not be isolated incidents but compounding exposures where operational, regulatory, cyber, climate, and reputational risks intersect. In such an environment, the effectiveness of a risk function will be judged not by how efficiently losses are settled, but by how consistently uncertainty is anticipated, absorbed, and converted into strategic advantage.

TCOR will increasingly serve as the foundation for this evolution. As organisations mature, TCOR metrics will move beyond reporting dashboards and become embedded into capital planning, pricing decisions, supply-chain design, and performance evaluation. Risk leaders will be expected to forecast risk trajectories, not just account for past losses.