Risk Management and Stress Testing in Indonesia: When Companies Need an Independent Review

Most risk registers in Indonesia look accurate on the day the board approves them. The trouble starts the following quarter. The rupiah moves, a key customer stretches its payment terms from 60 to 120 days, a refinancing lands at a higher rate than budgeted, and the register still shows the same tidy mix of green and amber cells it showed in January.

Nothing in the document is technically wrong. It simply stopped describing the company.

That gap between a register that is current on paper and a business that has quietly changed is where most risk failures begin. It is also why risk management stress testing in Indonesia has moved from a banking discipline into a boardroom question for manufacturers, distributors, PT PMA subsidiaries, and growing local groups. Consider a telling detail from the central bank. In its February 2026 policy statement, Bank Indonesia reported that its stress tests show the banking system remains resilient, and it explained that resilience as being supported by the repayment capacity and profitability of corporate borrowers. In other words, the stability of the system assumes that companies like yours can absorb a shock. The real question is whether anyone inside your company has actually tested that assumption.

Why a Clean Risk Register Can Still Hide a Fragile Company

A risk register answers one question: what could go wrong, and how likely is it? That is necessary, but it is not sufficient. Directors also need to know how much damage a bad year would do, how quickly cash would run out, and which combination of events would push the company past the point of recovery.

Those are stress testing questions, and they require a different kind of analysis.

Risk management and stress testing are related, not identical

The two disciplines feed each other, yet they answer different questions:

• Risk management identifies, rates, assigns, and monitors risks across the business. Its output is usually a register, a risk appetite statement, and a set of controls.
• Stress testing takes the most material risks and asks what happens to cash flow, profit, covenants, and capital under severe but plausible scenarios.
• Reverse stress testing works backwards. It starts from failure (a breached covenant, a missed payroll, insolvency) and identifies which scenarios would cause it.

Many companies do the first well and skip the other two. The result is a framework that describes risks in qualitative terms but cannot tell the board whether the company would survive a 20 percent revenue decline combined with a sharp currency move.

It also helps to separate stress testing from regulatory mapping. A compliance risk assessment for Indonesian companies tells you which legal obligations you might be breaching. A stress test tells you whether your balance sheet can carry the consequences when several things go wrong at once. Mature companies need both, and they should not confuse one for the other.

Explore Our Services Risk Assessment in Indonesia

What Indonesian Regulation Actually Requires in 2026

The regulatory picture depends heavily on the sector. Financial institutions face explicit, detailed rules. Most other companies face something less visible but arguably more personal: the liability of their directors.

Banks and financial services companies

For regulated financial institutions, risk management is a binding prudential obligation supervised by the Financial Services Authority (OJK), not a choice:

• Commercial banks remain subject to OJK Regulation No. 18/POJK.03/2016 on risk management for commercial banks. Several of its articles relating to bank products were later revoked by OJK Regulation No. 13/POJK.03/2021, but the core framework stays in force.
• Insurance companies, guarantee institutions, and pension funds moved to a new regime on 1 January 2026, when OJK Regulation No. 28 of 2025 took effect and revoked POJK 44/POJK.05/2020. The new rule brings guarantee institutions into scope, adds a dedicated risk management unit to the required organization, and requires a self assessment of the risk profile followed by a risk profile report.
• Finance companies, venture capital firms, microfinance institutions, and other financial service providers have followed OJK Regulation No. 42 of 2024 since late December 2024. It builds risk management on four pillars: active oversight by the board of directors, the board of commissioners, and (where relevant) the sharia supervisory board; adequate risk management policies and procedures; an adequate process for identifying, measuring, monitoring, and controlling risk, supported by a risk management information system; and an internal control system.

For a foreign group building a regulated business, these requirements surface early, often during the licensing stage itself. The process outlined in our guide to fintech licensing requirements for foreign companies shows how OJK examines the risk management framework before a license is even granted.

Non financial companies

Outside the financial sector, there is no general regulation that forces a manufacturer or trading company to run a formal stress test. That absence is often misread as freedom from obligation.

It is not. Under Article 97(3) of Law No. 40 of 2007 on Limited Liability Companies (as amended by the Job Creation Law), each director is personally and fully liable for company losses if they are at fault or negligent in performing their duties. Article 97(5) offers a defense, but only if the director can prove all four of the following:

• the loss was not caused by their fault or negligence;
• they managed the company in good faith and with prudence, in the company’s interest and in line with its purposes;
• they had no direct or indirect conflict of interest in the management action that caused the loss; and
• they took action to prevent the loss from arising or continuing.

The second and fourth conditions matter most here. A director who approved an expansion, a large borrowing, or a concentrated customer contract without ever testing the downside will find it difficult to argue that they acted with prudence, or that they took action to prevent the loss. A documented stress test, reviewed by someone who did not build it, is one of the clearest forms of evidence a board can produce.

Lenders and investors apply similar logic. Frameworks such as ISO 31000 and COSO’s Enterprise Risk Management guidance are voluntary, yet they have become the reference point that banks, private equity investors, and foreign parent companies use when they ask, “How do you know your numbers hold up?” Companies preparing for statutory or lender driven audits will find that Indonesia’s audit requirements for PT PMA and local companies increasingly push the conversation toward the quality of management’s risk assumptions, not only the accuracy of historical figures.

Seven Signals That Your Company Needs an Independent Review

Not every company needs an outside review every year. Some situations, however, make self assessment unreliable. If two or more of the following apply, an independent review is usually justified.

Your risk ratings have not moved in four quarters

If the economy, your customer base, and your funding costs have all shifted, but your top ten risks carry the same scores they carried a year ago, the process has likely become a formality. Static ratings in a changing environment are a warning sign, not a sign of stability.

A major transaction is on the table

Acquisitions, divestments, joint ventures, and large capital projects change a company’s risk profile overnight. Buyers increasingly expect the target’s risks to be quantified, not just listed. The same discipline described in our due diligence checklist for investing in Indonesian companies applies in reverse: if you are the one being examined, your stress testing should survive the buyer’s scrutiny.

You are refinancing or renegotiating covenants

A loan agreement signed in a low rate environment can look very different at renewal. Before you sign new covenants, you should know exactly how much headroom remains under a downside scenario and which ratio breaks first.

The business has grown faster than its controls

A new product line, a new province, or a doubling of headcount often outpaces the risk function. The register may still reflect the company of three years ago.

Tax and regulatory exposures sit outside the model

Many financial stress tests ignore contingent liabilities such as unresolved tax positions, permit gaps, or labor claims. These are exactly the items that crystallize during a downturn. A tax health check before a DJP audit is one way to bring those exposures into numbers that a stress scenario can actually use.

The same team built the model and checked it

This is the most common weakness, and the least discussed. When the finance team designs the scenarios, chooses the assumptions, and then reviews its own output, the result reflects that team’s blind spots.

Your board or parent company is asking harder questions

When commissioners, a foreign headquarters, or a new investor start requesting scenario analysis, a credible answer usually needs a second opinion behind it.

Why “Independent” Means More Than “External”

For a board, the value of a review depends on one thing: whether the reviewer had any part in building what is being reviewed. An outside consultant who designed your risk model cannot credibly sign off on it. An internal audit team that reports directly to the board of commissioners can, as long as it has the technical depth to challenge financial assumptions. Many mid sized companies in Indonesia simply do not have that capacity in house, which is why the review usually goes outside.

What matters to directors is what the review actually delivers. A credible independent review gives the board clear answers to five questions:

• Are the scenarios severe enough? Or were they chosen because the results look comfortable?
• Are linked risks tested together? Currency, commodity prices, and customer liquidity tend to move at the same time, so testing them one by one understates the damage.
• Can the numbers be trusted? The data behind the model should be complete, current, and reconciled to the financial statements.
• Is there a plan before the crisis? Management should have agreed trigger points and actions in advance, not improvised them under pressure.
• Did the board engage with the results? A stress test that was never discussed and minuted offers directors little protection.

When those five answers are documented, the board holds something more useful than a report. It holds evidence that it made decisions with its eyes open, which is exactly what lenders, investors, and Article 97 of the Limited Liability Companies Law expect.

What a Useful Stress Test Looks Like for an Indonesian Company

A stress test borrowed from a European parent company, or downloaded as a template, rarely reflects the shocks that actually hit Indonesian businesses. Good scenarios are local, specific, and uncomfortable.

Scenarios grounded in Indonesian conditions

The most relevant scenarios for most Indonesian companies combine several of the following:

• Currency pressure. In February 2026, Bank Indonesia itself described the rupiah as undervalued relative to Indonesia’s economic fundamentals, after a period of weakness driven by global market uncertainty. Companies with imported inputs or dollar debt need to know their breaking point.
• Funding and interest rate shifts. Changes in lending rates affect both the cost of debt and the liquidity of your customers.
• Customer concentration. The loss or delayed payment of one or two major buyers often does more damage than any macroeconomic variable.
• Commodity price swings. For businesses linked to nickel, coal, palm oil, or energy, price volatility moves revenue and input costs at the same time.
• Regulatory and licensing disruption. An operational shock can come from an administrative source. A blocked NIB in the OSS system can halt imports, tenders, and banking transactions almost immediately.

Outputs the board can act on

The value of a stress test lies in what the board can do with it. A strong output gives directors:

• A liquidity runway under each scenario, expressed in months
• Covenant headroom and the first ratio likely to breach
• A short list of management actions with clear triggers and owners
• A reverse stress result showing the combination of events that would threaten solvency

Weaknesses that reviews commonly uncover

When stress testing frameworks are reviewed, the same issues tend to appear. Scenarios are calibrated to last year’s mild conditions. Correlated risks are tested in isolation. Contingent liabilities are left out. Most often, the results never reach a board discussion at all, which leaves directors with the paperwork of risk management but none of its protection.

For transactions specifically, these gaps carry a price. The process described in our overview of M&A in Indonesia and its key regulatory considerations shows how buyers convert unquantified risk into lower valuations, larger escrows, or tougher warranties.

The companies that handle this well tend to share one habit. They treat the stress test as a decision tool that is revisited whenever the business changes, rather than as an annual document that is filed and forgotten. They also accept that the people closest to the numbers are rarely the best people to challenge them.

That is the role XPND’s strategic advisory team is built to play. Working alongside finance teams, directors, and commissioners, XPND reviews existing risk frameworks, rebuilds stress scenarios around the realities of operating in Indonesia, and turns the results into evidence a board can rely on when lenders, investors, or regulators ask how decisions were made. If your company is approaching a refinancing, a transaction, or a board cycle where the old assumptions no longer feel safe, this is the right time to test them, before circumstances test them for you. Speak with XPND’s strategic advisory team to scope an independent review of your risk management and stress testing framework.