Risk Management

Risk and Governance

Enterprise Risk Management (ERM) is a strategic and structured approach adopted by NPTC to identify, assess, mitigate, and monitor potential risks that may impact its business operations, performance, and long-term sustainability. In alignment with the SEBI (Listing Obligations Disclosure Requirements and Business Responsibility and Sustainability Reporting (BRSR) framework, the company’s ERM framework integrates environmental, social, and governance (ESG) risks alongside traditional financial and operational risks. A Director level Sub-committee of the Board, Risk Management Committee (RMC) has been constituted to oversee the Enterprise Risk Management.

This committee is chaired by the Director (Projects), with Director (Operations), Director (Fuel), two Independent Directors, and Chief Risk Officer (CRO) serving as members. RMC oversees risk management, ensuring that material risks, including climate change, regulatory compliance, cyber security and supply chain disruptions, and stakeholder concerns are proactively managed. Dynamics, thereby fostering resilience, informed decision-making, and value creation for all stakeholders. The RMC operates with the pivotal role of identifying and evaluating risks, prioritizing them accordingly, and devising timely action plans for effective mitigation.

• Developing a comprehensive Risk Management Policy that encompasses the identification of internal and external risk specific to the organisation, such as financial, operational, sectoral, ESG , information and cyber security risks, or any other risks determined by the committee.
• To monitor and oversee implementation of the risk management policy, including evaluating the adequacy of risk management and internal control systems.
• Ensure that appropriate methodology, processes, and systems are in place to monitor and evaluate risks associated with the business of the Company.
• To review the risk management policy on annual basis, including by considering the changing industry dynamics and evolving complexity.
• To keep the board informed about the nature and content of its discussions, recommendations, and actions to be taken.

• Operational Risks
• Legal and Compliance Risks
• Strategic Risks
• Environmental and Social Risks
• Technological Risks
• Financial Risks

The organization proactively manages enterprise risks, assessing their nature and impact on operations, activities, and long-term objectives. Details on risk management strategies are provided in the next section,highlighting proactive measures to mitigate risks and ensure resilience.

Legal Risk

With changing legal and regulatory landscape in the country, manylegal issues are emerging with the growth in the business. As dispute take longer time to settle, there is a risk of contracts not being closed in a time bound manner.

A Dedicated Arbitration cell created to work in close coordination with best legal advisors and industry partnership to clear cases on priority.

Mechanism like Conciliation Committees of Independent Experts (CCIE), Expert Settlement Council, Vivad-Se-Vishwas, Independent Engineer (for Hydro Projects) are also utilized for dispute avoidance. Many cases have been resolved through Mutual Consultation.

Focus is on capability enhancement for employees to minimize disputes.

Regulatory And Compliance Risks

• Environmental norms for thermal power plants require substantial reduction in SPM, SOx, NOx emissions.
• 100% ash utilisation by thermal plants are other risk areas.
• Enhanced load ramping requirements.
• NTPC is installing Flue Gas Desulphurisation systems at a massive scale for its thermal power plants for SOx control and combustion modification for de- NOx. ESPs have been modified for SPM control.
• Dry Ash Evacuation System (DAES) & High Concentration Slurry Discharge (HCSD) technology are used to minimize use of water in Ash handling. Further, new avenues for ash utilisation such as roads and building construction, mine filling and long term off take agreements have been continuously explored.
• NTPC has retrofitting, upgrading its thermal assets to fulfil the ramping rate requirements.

Policy Shift In Power Procurement

The power sector is slowly shifting from a regulatory regime to a market driven regime. The tariffs of new projects are being explored through competitive bidding. Being an asset heavy business model, shifting from a fixed RoE to market-based earning leads to uncertainties and risks.

NTPC contributes more that 24 % of India’s power requirement with about 17% of installed capacity. In terms of variable cost, NTPC has been consistently maintaining competitive edge over its peers. Additionally, NTPC has been leveraging market mechanism like Security Constrained Economic Despatch (SCED). Regular market analysis and forecasting is enabling NTPC to anticipate demand accurately. This includes monitoring factors such as fuel prices, electricity demand, regulatory changes, and other factors in the power value chain.

Financial Health Of Discoms

Poor financial health of the DISCOMS affecting the bill realization and cashflows remains a risk.

NTPC has in place a robust payment security mechanism in the form of Letters of Credit (LC) backed by the Tri-Partite Agreement (TPA). In addition to the LCs, payment is secured by the Tri-Partite Agreements (TPAs) signed amongst the State Governments, Government of India (GoI) and Reserve Bank of India (RBI).

Climate Change: Physical Risk

Climate change is posing both physical and transition risks to all business entities including NTPC. The risks associated with the increase in sea levels, water stress situations, increased heat waves, erratic rainfall and frequent natural disasters may impact the business.

NTPC has an enhanced geographical and technology diversification. NTPC operates across more than 109 locations in India and abroad, inherently reducing risks to any individual location specific natural catastrophe. As part of NTPC’s preparedness against such situations, our power plants and infrastructure are designed to withstand climate extremes—floods, heatwaves, and cyclones. The cooling systems are designed to withstand the increase in water temperatures brought forth by climate change. The sites are geo-strategically diversified, and climate risk assessments are being integrated into planning. A resilience strategy is being built through enhanced early warning systems and infrastructure retrofits.

Climate Change: Transition Risk

Rising climate change concerns and threats may bring future policy and regulatory risks in terms of carbon tax and cess.

To de-risk its business from transition risk, NTPC is making substantial progress towards diversification of its business and decarbonization of energy through increasing penetration of renewables in its portfolio. It is aimed to increase RE capacity to 60GW by 2032. The Company is developing RTC projects with hybrid RE and storage, and has initiated Green Hydrogen pilots in Leh and floating solar at Ramagundam. Carbon Market readiness, CDP disclosures, and internal carbon pricing tools are being developed.

Water Security

As a proactive measure to avoid any risk due to water scarcity in future, NTPC has adopted a policy of Reduce, Reuse and Recycle (3Rs) for the water being consumed in its station and projects.

The proactive measures for water conservation include process improvements and technology adoption in all possible manners. Some of the key measures being adopted at power generating stations are:

• Optimisation of cycles of concentration (COC)
• Implementation of ZLD to reduce freshwater consumption,
• Adoption of Air-Cooled Condenser (ACC) based cooling in water stressed locations etc
• Dry Ash Evacuation System (DAES) & High Concentration Slurry Discharge (HCSD) technology to minimize use of water in Ash handling.

Cyber Security Risk

Risks to Power Supply System resulting from Cyber intrusion attempts and Cyber-attacks on the plant DCS system as well as grid system operation network have potential to endanger the secured grid operation.

NTPC has significantly strengthened its cyber defense ecosystem through alignment with CERT-In, CEA, and NCIIPC guidelines. A 24x7 Security Operations Center (SOC) is operational to monitor and mitigate threats in real-time. The Company has deployed an Integrated Security Awareness Platform from EC-Council (a global cybersecurity leader) to institutionalize workforce training. Advanced tools like Zero Trust Network Access, Deception Technology, and Unified Endpoint Security and Vulnerability Management have been rolled out. Further, a cloud-based Web Application and API Protection (WAAP) platform has been deployed in learning mode to enhance NTPC’s resilience against evolving digital threats. Periodic VAPT audits and OT-IT segregation continue to reinforce infrastructure security.

NTPC is exposed to financial risks including interest rate fluctuations, currency volatility, delays in DISCOM payments, and cost overruns in capital projects. These risks can impact borrowing costs, liquidity, and financial planning. Effectively managing these risks is essential to sustaining NTPC’s credit profile, investment capability, and long-term stability.

NTPC maintains a strong AAA credit rating, enabling access to low-cost, long-term capital. It uses refinancing strategies, monitors interest rates, and is evaluating green and ESG-linked financing instruments. Currency exposure is managed via natural hedging and forward contracts. Liquidity is secured through Letters of Credit and Tripartite Agreements with State Governments and RBI. SAP-based receivable tracking, ALM reviews, and stress testing further strengthen resilience. To manage project execution risk, NTPC employs milestone-based tracking, centralized procurement, and EPC contracting frameworks.

Effectiveness Of Risk Management

To ensure the effectiveness of the risk management process, regular review, and recalibration, of the mitigation measures adopted by the functions, is done by the Risk Management Committee. The risk management policy and framework are also updated based on the evolving regulatory environment and market dynamics. To ensure the alignment with the ISO 31000 guidelines, compliance assurance is sought by external bodies.

RMC Meetings

Committee Composition, Meetings & Attendance

During the financial year 2024-25, the RMC was reconstituted from time to time. During the FY 2024-25, two (2) Meetings of the Risk Management Committee were held on 16th July 2024 and 3rd February 2025.