The Silent Balance Sheet Destroyer: How Weak Risk Frameworks Unravel Mid-Cap Companies

In the post-pandemic credit surge, many Indian mid-cap companies expanded aggressively, entering new geographies, adding subsidiaries, taking on new credit lines and pursuing larger projects.

What many failed to build alongside that growth was a functioning risk management framework.

That omission can be expensive.

Our work across forensic accounting, corporate governance and financial advisory engagements has repeatedly shown that financial distress does not always begin with a market crash, operational failure or rogue promoter. In many cases, the warning signs appear years earlier in the company’s risk governance architecture.

Receivables become concentrated. Subsidiary guarantees accumulate. Short-term debt finances long-cycle assets. Internal audit becomes procedural. Board risk committees become approval mechanisms.

The balance sheet may continue to look healthy, until one trigger exposes the underlying weaknesses.

This is the silent balance sheet destroyer.

The Pattern Is Not Random

A recurring pattern emerges when mid-cap companies are examined after a liquidity event, covenant breach, default or restructuring.

A business that appeared operationally sound begins showing signs of financial stress. A closer forensic examination often reveals that the problem was not created overnight.

The risks had been accumulating for years.

The company may have had an enterprise risk management policy. It may have had a risk committee. It may have disclosed risks in its annual report.

But documentation is not risk management.

A functioning risk framework for a mid-cap company must identify exposures, quantify their potential impact, establish thresholds, assign accountability and trigger action before a risk becomes a financial event.

The distinction is critical.

What Does a Risk Framework Actually Mean?

A risk framework is not simply a section in an annual report.

It is not a colour-coded heat map presented to the board twice a year.

It is not an enterprise risk management policy sitting on an internal portal.

A functioning risk management framework is a live decision-making system embedded across the organisation.

It should answer, at any given point:

• What financial and operational exposures are we accumulating?
• Which counterparties represent our largest concentrations?
• How much exposure exists at subsidiary and group level?
• What contingent liabilities have been created?
• Are our borrowing maturities aligned with our cash flows?
• How much covenant headroom do we have?
• What happens under a stressed interest-rate or liquidity scenario?
• Who is responsible for escalation when a risk threshold is breached?

When these questions cannot be answered quickly and quantitatively, the organisation does not have effective risk governance.

It has risk documentation.

The Five Risk Management Failures That Can Destroy a Mid-Cap Balance Sheet

1. Counterparty Concentration Without Covenant Protection

One of the most common weaknesses we encounter is excessive concentration in the receivables book.

A company may have 40-60% of its receivables concentrated among a small number of counterparties, without adequate contractual protection, payment covenants or escalation mechanisms.

The problem is not simply that a customer may pay late.

When a major counterparty experiences liquidity stress, the impact can spread across the balance sheet:

Customer stress → delayed collections → working-capital pressure → higher borrowing → provisioning → covenant pressure → liquidity deterioration

A disciplined risk framework should establish exposure limits, monitor counterparty credit quality and require enhanced protection once concentration crosses defined thresholds.

Without those controls, the CFO often discovers the true extent of the problem when the counterparty has already defaulted.

2. Hidden Risk Through Subsidiaries and SPVs

Growth frequently creates another blind spot: subsidiaries, joint ventures and special purpose vehicles.

These entities may be established to enter new businesses, execute projects or raise financing.

The problem arises when group-level risk is not consolidated properly.

Parent guarantees may accumulate without adequate monitoring.

Intercompany receivables may continue to be treated as assets without sufficiently testing their recoverability.

Subsidiary-level borrowing may remain outside the parent’s core risk calculations.

The standalone parent balance sheet can therefore look significantly stronger than the economic reality of the group.

A subsidiary’s lender invoking a parent guarantee can suddenly transform a contingent exposure into an immediate cash requirement.

Effective corporate risk management requires visibility across the entire group, not simply the standalone financial statements.

3. Treasury Policies That Do Not Match the Business Risk Profile

Treasury risk is often underestimated during periods of easy liquidity.

Consider a company with long-cycle project revenues, such as construction, infrastructure or export-linked manufacturing, funding those assets primarily through short-term working-capital facilities.

That creates an asset-liability mismatch.

The business depends on continuous refinancing to fund assets whose cash flows may take years to materialise.

When interest rates rise or lenders tighten credit standards, the mismatch becomes visible.

Debt may have to be rolled over at significantly higher spreads. Credit limits may be reduced. Covenant headroom may disappear.

The balance sheet does not necessarily collapse in one quarter.

Instead, it erodes gradually through:

• Rising interest costs
• Lower DSCR
• Reduced liquidity
• Higher refinancing risk
• Covenant breaches
• Increasing dependence on lenders

A robust treasury risk framework should therefore include maturity analysis, liquidity buffers and scenario-based stress testing.

4. Internal Audit That Confirms Controls Instead of Testing Them

Risk identification without independent verification is incomplete.

The internal audit function should not simply confirm that a control exists.

It should determine whether the control actually works.

In our experience, weaknesses often arise when internal audit lacks sufficient mandate, access, technical capability or independence to challenge the financial architecture of the business.

Consider related-party transactions.

They can represent one of the most important risk areas in promoter-driven businesses, yet an internal audit scope that does not adequately test them can leave significant exposures unidentified.

Similarly, a control may exist on paper while being ineffective in practice.

This is why internal audit and risk management must operate as complementary mechanisms.

Risk management identifies and monitors exposure.

Internal audit independently tests whether the control environment is actually functioning.

5. Board Risk Committees That Become Approval Engines

The final failure point sits at the top.

Governance requires challenge.

A board risk committee that receives management-prepared dashboards and approves them without meaningful questioning may satisfy a formal governance process while failing its substantive responsibility.

The distinction between compliance and effective governance matters.

Boards should challenge:

• Management risk assumptions
• Counterparty concentrations
• Liquidity forecasts
• Related-party exposures
• Subsidiary guarantees
• Stress-test assumptions
• Covenant headroom
• Risk appetite limits

The key question is not whether the board has rejected a management recommendation.

It is whether the board has created an environment in which management knows that recommendations will be challenged when risk exceeds the company’s capacity to absorb it.

The Balance Sheet Destruction Sequence

These five failures rarely operate independently.

Their interaction is what creates the most serious damage.

A typical mid-cap financial distress cycle can develop in four stages.

Phase 1: Risk Accumulation

Years 1-3

Receivables become increasingly concentrated.

Subsidiary guarantees grow.

Short-term borrowing increases.

Internal audit continues its regular cycle without identifying material weaknesses.

Management continues reporting satisfactory performance.

The board sees a business that appears healthy.

Phase 2: Trigger Event

Month 1

A major counterparty defaults.

A subsidiary requires funding.

A credit facility is not renewed.

Interest costs increase sharply.

A covenant is breached.

The trigger itself may be relatively small compared with the size of the business.

The problem is the accumulated exposure behind it.

Phase 3: Financial Revelation

Months 2-6

A forensic review is initiated by lenders, the board, investors or management.

The examination identifies:

• Recoverability issues
• Unrecognised contingent exposures
• Group-level leverage
• Related-party risks
• Weak controls
• Liquidity gaps
• Provisioning requirements

The company’s economic position suddenly looks very different from its historical reporting.

Phase 4: Resolution or Insolvency

Months 6-18

Management is forced to restructure the business, raise capital, sell assets, renegotiate debt or pursue formal insolvency proceedings.

By this stage, shareholder value may already have been substantially destroyed.

The critical point is that the balance sheet did not necessarily fail when the trigger occurred.

It failed when the organisation allowed the underlying risks to accumulate without effective intervention.

Regulatory Compliance Is Not the Same as Risk Effectiveness

Indian companies operate within a substantial regulatory framework covering governance, internal controls, risk management and financial reporting.

However, the existence of regulatory requirements does not automatically create an effective risk framework.

A company can satisfy the formal requirements of its governance and disclosure regime while maintaining a risk-management system that would fail under the first serious stress scenario.

That is the difference between risk framework compliance and risk framework effectiveness.

The next evolution of corporate governance should therefore move beyond asking:

Does the company have a risk management framework?

The more important question is:

Has the company’s risk framework actually been tested?

Boards, investors and lenders should increasingly expect evidence of:

• Scenario analysis
• Liquidity stress testing
• Counterparty concentration monitoring
• Subsidiary risk consolidation
• Covenant stress testing
• Treasury maturity analysis
• Independent control testing
• Board-level risk escalation

A risk framework should be judged by how it performs under pressure, not by how well it reads in an annual report.

Five Questions Every Mid-Cap Board Should Ask Today

A board does not need another 100-page risk policy to understand whether its framework is working.

Start with five questions.

1. What is our top-five counterparty concentration?

What percentage of total receivables comes from our five largest counterparties?

What is their current credit quality?

What happens if the largest counterparty stops paying for 90 days?

2. What contingent liabilities exist across the group?

What guarantees, commitments and subsidiary-level obligations exist that may not be visible on the standalone balance sheet?

What would happen if those guarantees were called simultaneously?

3. How exposed are we to refinancing and interest-rate risk?

What is our asset-liability gap by maturity?

What happens to DSCR and free cash flow if short-term interest rates increase by 150 basis points?

4. When was internal audit last genuinely independent?

When did internal audit last test related-party transactions, treasury controls, subsidiary exposures and key financial controls?

Were the findings independently escalated to the audit committee?

5. Has the board ever rejected a management recommendation on risk grounds?

If the answer is “never”, the board should ask why.

A risk committee that never challenges management may be functioning as an approval mechanism rather than a governance mechanism.

If the honest answer to any of these questions is “we don’t know”, that is not the end of the exercise.

It is where remediation begins.

How Boards Can Stress-Test Their Risk Framework

A strong risk management framework for mid-cap companies should be tested against adverse but plausible scenarios.

For example:

Counterparty Stress: What happens if the company’s largest customers delay payments by 90–180 days?

Liquidity Stress: What happens if working-capital facilities are reduced by 20%?

Interest-Rate Stress: What happens if borrowing costs rise by 150–200 basis points?

Subsidiary Stress: What happens if a major subsidiary requires an emergency capital infusion?

Guarantee Stress: What happens if multiple parent guarantees are invoked?

Revenue Stress: What happens if revenue falls 15–20% while fixed costs remain unchanged?

The objective is not to predict the future.

It is to understand whether the company has sufficient liquidity, capital and governance capacity to absorb an adverse event.

That is what risk management is ultimately designed to achieve.

The Real Cost of Weak Risk Governance

Mid-cap companies occupy an important position in India’s corporate economy.

They are large enough to have significant debt, complex group structures and institutional stakeholders, but often lack the balance-sheet depth and organisational redundancy of the largest corporations.

That makes effective corporate governance and risk management particularly important.

The cost of weak risk governance is rarely limited to one accounting adjustment.

It can spread across the organisation:

Weak controls → unidentified exposure → liquidity pressure → higher financing costs → covenant breach → lender intervention → restructuring → loss of investor confidence

By the time the market sees the problem, the organisation may already be years into the deterioration cycle.

Final Closure

The balance sheets being quietly damaged today are not necessarily being destroyed by markets.

They may be being destroyed by risks that management and boards allowed to accumulate when the business was still growing.

A functioning risk framework is built before the crisis, not during it.

The objective is not to eliminate risk.

It is to ensure that the company understands the risks it is taking, measures them properly, assigns accountability and acts before those risks become existential.

The cost of building that architecture is measurable.

The cost of not building it can be the company itself.