How to Draft DRHP Risk Factors That Hold Up in SEBI Review

While building Prefyle’s chapter-drafting prompts, I’ve spent a lot of time with DRHPs and with the published analysis of what SEBI asks bankers to change in them. The risk factors chapter keeps coming up. This guide pulls together what ICDR requires, what SEBI’s comments tend to focus on, and the issuer data you’ll probably want in hand before you start drafting.

Why risk factors draw the most SEBI comments

One study puts a number on this. Uniqus analysed SEBI’s observation letters on recent IPO filings and found that an issuer receives close to 100 comments on average, with nearly 46% of them relating to the Risk Factors section (India IPO Insights, October 2025). When the study was covered again in March 2026, compliance and regulatory disclosures came second at about 13%. It’s one firm’s sample of letters, so I’d read the exact split as directional.

The cost of a comment also tends to outlast the letter. In January 2026, SEBI fined Gretex Corporate Services ₹15 lakh for several lapses, one of which was failing to incorporate changes SEBI had advised in an observation letter dated January 18, 2024 (adjudication order). Every comment has to be closed out in the RHP, so a draft that attracts fewer comments usually leaves a shorter list to track (and fewer chances to miss one).

What ICDR Schedule VI requires

The rules for this chapter sit in Part A of Schedule VI to the SEBI ICDR Regulations, 2018, under the item on risk factors. They’re short enough to reread before every draft. The text below is quoted from the consolidated regulations.

• Internal vs external. “Risk factors shall be classified as those which are specific to the project and internal to the issuer and those which are external and beyond the control of the issuer.”
• Materiality. “Risk factors shall be determined on the basis of their materiality.” Three considerations apply: “Some risks may not be material individually but may be material when considered collectively”, “Some risks may have an impact which is qualitative though not quantitative”, and “Some risks may not be material at present but may have a material impact in the future.”
• Order. “Risk factors shall be disclosed in the descending order of materiality.”
• Quantification. Where material impact is stated, “likely or potential implications, including financial implication, wherever quantifiable shall be disclosed. If it cannot be quantified, a distinct statement about the fact that the implications cannot be quantified shall be made.”
• Structure. Each risk factor appears as “The risk as envisaged by the issuer”, followed by “Proposals, if any, to address the risk.”
• Limits on proposals. Proposals “shall not contain any speculative statement on the positive outcome of any matter or litigation, etc. and shall not be given for any matter that is sub-judice before any court/Tribunal.”

The same item then lists 32 subjects that must be covered wherever applicable (losses in the last three financial years, dependence on a few customers, negative operating cash flow, pending statutory approvals, etc.). I’d lean hardest on the quantification line. It allows two outcomes, a number or a plain statement that there isn’t one, and a sentence like “this could adversely affect our business” usually fits neither.

Ranking by materiality, and why the top 10 matters

Since the ICDR amendments of March 2026, the abridged prospectus format carries “the top 10 internal Risk Factors in the summarized form” (amendment text). A draft abridged prospectus now also has to be filed and hosted alongside the DRHP. So your first ten internal risks are probably what a retail investor reads, often before anything else in the document.

SEBI’s comments point the same way. Uniqus found that its placement comments focus on investors being able to identify the top 5, top 10 and top 25 risks. Schedule VI also names one risk that must sit in the top 10: restated or proforma financials certified by a peer-reviewed CA who isn’t the statutory auditor.

Here’s how that plays out for an invented issuer: an auto-components manufacturer with ₹420 crore of FY26 revenue, two OEM customers making up 58% of it, 22% of revenue from US exports, negative operating cash flow in FY25, and a pending consent-to-operate renewal at its second plant.

Rank	First draft (copied structure)	Re-ranked by materiality
1	Slowdown in the Indian economy	Two OEM customers contribute 58% of revenue
2	Intense competition in our industry	Pending consent-to-operate renewal at Plant 2 (41% of FY26 output)
3	Exchange rate fluctuations	22% of revenue from US exports, exposed to tariff changes
4	Dependence on key managerial personnel	Negative operating cash flow of ₹18.6 crore in FY25
5	Two OEM customers contribute 58% of revenue	Steel price volatility (raw material is 62% of cost)

The first draft reads like a template, with the issuer’s largest exposure in fifth place and a pending approval missing entirely. In the re-rank, the economy-level risks move to the external section, where Schedule VI’s classification puts them anyway.

Headings with numbers in them

Uniqus lists “quantitative headings” as a recurring comment: SEBI wants key quantitative and qualitative details in the heading itself. The newsletter doesn’t cite a rule for this. The closest anchor I can find is the Schedule VI quantification line quoted above, which asks for financial implications wherever quantifiable. The abridged prospectus carries the top 10 in summarized form, and a summary usually leans on the heading, so a number left deep in the body might never reach the investor reading it.

Three before-and-after headings for the same invented issuer:

1. Before: We depend on a limited number of customers for a significant portion of our revenue.
   After: Our two largest customers, both passenger-vehicle OEMs, contributed 58.3% of our revenue from operations in FY26 (54.1% in FY25). Losing either customer, or a reduction in their orders, could reduce our revenue and profitability.
   
2. Before: Changes in international trade policy may affect our business.
   After: Exports to the United States made up 22.4% of our revenue from operations in FY26. Additional US tariffs on auto components could reduce demand from these customers or lower our margins on those sales.
   
3. Before: We have experienced negative cash flows in the past.
   After: We had negative net cash flow from operating activities of ₹18.6 crore in FY25, mainly because trade receivables rose by ₹41.2 crore. Negative operating cash flows in future could affect our ability to fund working capital and service debt.

Once a number sits in the heading, it has to match the restated financials, MD&A and business chapter to the decimal. I’d add a tie-out step for every heading figure before filing.

Issuer-specific risks SEBI keeps asking for

The Uniqus list of recurring comments is short, and nearly every item asks for something specific to the issuer. I’ve grouped them into four areas below, with the data I’d pull for each before drafting a word.

Concentration and contracts

SEBI’s comments cover supplier concentration, customer concentration and geographic concentration of customers. Schedule VI separately requires a risk factor on dependence on “a single customer or a few customers”. A related ask: where the company has no long-term agreements with its vendors, that gap is disclosed as its own risk factor. I’d say it plainly, e.g. “We procure steel on a purchase-order basis and have no long-term supply agreements with any supplier.”

Data to pull:

• Revenue share of the top 1, top 5 and top 10 customers, for every period in the restated financials
• Top 10 suppliers as a share of purchases
• Revenue by state and by country
• Contract terms for key customers and suppliers: tenure, exclusivity, termination notice, price-revision clauses, and whether the relationship runs on a master agreement or on purchase orders

Financial stress

SEBI asks for risks on negative cash flow from operations, rising working capital requirements and a lack of profitability. Two of these are also on Schedule VI’s mandatory list: losses in the last three financial years, and negative operating cash flow over the same period.

There’s a detail in the original Uniqus newsletter that later news coverage of the study leaves out. Under objects of the issue, where working capital is being funded, SEBI asked issuers to justify a sharp jump in the working capital estimate over the prior year and to disclose the estimation risk as a separate risk factor, with data, the intended use and the CA certificate for the estimate. So for a working capital object, I’d draft two risk factors: one on historical working capital intensity, and one on the estimate itself.

Governance

For material transactions with promoters, promoter group entities and related parties, SEBI wants the reasons and the commercial justification disclosed. In practice that means each material related-party transaction as a share of revenue or purchases for every period, whether it was at arm’s length, who approved it, and why it exists (e.g. the factory sits on land leased from a promoter entity).

SEBI also asks for a risk factor on the inexperience of directors, and Schedule VI requires one where the issuer or its promoters lack significant experience in the segment. Back experience claims with documents: one of the failures cited in the Gretex order was relying on internal declarations, rather than evidence, to establish the financial literacy of audit committee members.

Offer structure and operations

Where the IPO is entirely an offer for sale, SEBI wants an explicit statement that the company will receive no proceeds. This comes up often. Uniqus estimates that offers for sale made up roughly 60% of issue value in Q3 2026 (India IPO Insights, October 2026).

For manufacturers only, SEBI has asked for a risk factor on the manufacturing facility becoming obsolete. A services or platform issuer can generally skip this one.

Pending approvals get their own risk factor wherever an approval hasn’t been obtained. This sits in the compliance part of the original newsletter, and again the news coverage drops it. Schedule VI lists material statutory clearances yet to be received as a mandatory subject, and SEBI also wants the impact of each pending approval on the company’s financials and operations assessed. For the invented issuer above, that’s the Plant 2 renewal with its share of output stated.

Macro risks shift each cycle

In the letters Uniqus reviewed for its October 2025 analysis, the macro ask was tariffs: SEBI wanted a risk factor on the potential impact of reciprocal tariffs imposed by the US. By Q3 2026, Uniqus was describing a market weighed down by tensions in West Asia, currency pressure and high crude prices, which may well become the next round of asks. I’d read the most recent observation letters you can access (your own mandates, plus published analyses) before drafting the external section, and quantify the issuer’s actual exposure (export share, imported input share, currency mix of borrowings, etc.).

Drafting mistakes that trigger comments

A peer DRHP is usually where a first draft starts, which is where the first two problems below tend to come from.

• Boilerplate copied from peer DRHPs. A peer’s chapter is a useful checklist of topics, but its wording describes the peer. Copied text often keeps the peer’s order of risks too, which is how a customer concentration risk ends up in fifth place.
• Figures that don’t match. A percentage in a risk factor that differs from the business chapter, MD&A or restated financials (even by a rounding step) tends to draw a comment asking which one is right.
• Generic risks with no issuer impact. Uniqus found SEBI asking for the specific financial or economic impact on the company rather than generic statements. If a risk would read the same in any DRHP, it probably needs a number or it belongs in the external section.
• Proposals that predict outcomes. “We believe the matter will be decided in our favour” is the kind of speculative statement Schedule VI rules out, and no proposal is allowed at all for a sub-judice matter.
• Unclear sentences. Schedule VI’s instructions ask for simple English and consistent use of first or third person. Long sentences that bundle three risks into one heading make it harder to rank each of them.

Pre-filing checklist

The full checklist is below. If you’d like a fuller version to use on your next mandate (the checklist plus the Schedule VI text and the worked issuer example), you can download the guide as a PDF with your work email.

Structure

• Internal and external risks are in separate sections
• Risks are in descending order of materiality, with the top 10 internal risks reviewed as a set
• Risks that are minor alone but material together are combined or cross-referenced
• Risks that aren’t material now but could be later are included

Content

• Every applicable subject from Schedule VI’s mandatory list is covered
• Customer, supplier and geographic concentration are quantified for every period
• Missing long-term vendor agreements are disclosed as a risk factor
• Negative operating cash flow, losses and working capital growth each have a risk factor where applicable
• A working capital object has a separate risk factor on the estimate
• Each pending approval has its own risk factor, with its impact on operations stated
• A 100% offer for sale states that the company receives no proceeds
• Material related-party transactions carry their commercial reason

Wording and numbers

• Headings carry the key number
• Each material risk has a quantified implication, or a distinct statement that it can’t be quantified
• Every figure ties to the restated financials, MD&A and business chapter
• No proposal predicts a litigation outcome, and none is given for a sub-judice matter
• The external section reflects the latest observation letters you have access to
• Comments from any earlier observation letter are incorporated and tracked

Where Prefyle fits

Prefyle can take on the first pass. Its chapter prompts draft risk factor text from the issuer’s own inputs, and Financial Report Summarisation summarises the financial reports you feed it, which helps when you’re pulling the figures each risk needs. The judgment calls stay with the banker: which risks are material, how they rank, what goes in the top 10 and what gets disclosed at all. I think of it a bit like a junior analyst’s first draft, where the useful part is having something concrete to mark up.

FAQ

Work with us as a design partner

We’re opening 2 to 3 design-partner slots for merchant bankers who’d like to run Prefyle on live mandates. The program runs for three months, and design partners cover the compute cost of their usage during that period. In return, we’d ask for structured feedback sessions along the way and, only if you’re willing, permission to share your results as a case study (you can opt out at any point). If you have a DRHP coming up and would like to try it on your risk factors chapter, apply for a design-partner slot.