Mphasis Ltd Management Discussions

The global economic environment in FY25 has had an increased level of uncertainty and unpredictability. There are some signs of recovery - particularly with the potential for interest rate cuts in the US and Europe—however, persistent inflation, tight credit markets, and continued geopolitical tensions (such as those in Eastern Europe, the Middle East, and the Red Sea) are influencing customer demand patterns. Additionally, tariff-related disputes and protectionist trade policies have begun to reshape global supply chains. While the IT Services sector has seen increased traction in GenAI, digital transformation, and cost-optimization programs, discretionary spending continues to be subdued.

From an industry standpoint, the emergence of Gen AI has led to rapid technological shifts, requiring accelerated adaptation by IT services companies. At the same time, regulatory scrutiny around data privacy, AI ethics, and environmental disclosures is intensifying across geographies. Talent models continue to evolve, with organizations fine-tuning their hybrid work strategies. This shift brings ongoing challenges around workforce engagement, productivity measurement, leadership visibility, and cultural cohesion in a distributed environment. While clients remain prudent with discretionary tech spending, demand remains strong for AI-led transformation, cybersecurity, platform-based services, and managed cost takeout initiatives.

In addition to proactively identifying and mitigating risks, the Companys Enterprise Risk Management program also aims to uncover potential opportunities embedded within risk themes. For instance:

• Cybersecurity and data privacy risks have led to the creation of managed security offerings, trusted cloud services, and privacy governance consulting capabilities.

• AI governance risks have driven demand for responsible AI frameworks and ethical AI advisory engagements.

• Cost and margin pressures at client organizations have expanded opportunities for delivering AI Ops, Service Led Transformation, automation-led managed services, and cost-takeout solutions.

The Company continues to monitor these developments to align investments and innovation initiatives accordingly.

At Mphasis, we are committed to proactive risk management to safeguard our business interests, optimize performance and ensure sustained value creation for our stakeholders. Our risk management framework encompasses strategic, operational, and compliance dimensions, enabling us to identify, assess, mitigate, and monitor risks effectively.

To provide the appropriate governance and oversight, given the criticality of risk management and to comply with the regulatory requirements, the Company formed the Risk Governance and Management Committee (RGMC) comprising of Board Directors and Companys senior executives to assist the Board in discharging its risk governance and oversight responsibilities. This Committee reviews the details of Risk Assessments undertaken by management every quarter.

At the management level, the Mphasis Risk Management Council (MRMC), provides the required oversight for the ERM program and monitors the progress on various identified enterprise risks and periodically reviews the mitigation efforts. The MRMC is comprised of four members of the ExCo team. There is a dedicated risk management function headed by Chief Risk Officer to coordinate all risk related activities across the enterprise and periodically report the status of enterprise risks to the Board/RGMC/Audit Committee/MRMC.

Risk Intelligence: Pursuant to our larger goal of making Mphasis a Risk Intelligent Organization, this program aims to spot the ‘Black Swans and manage ‘Gray Rhinos (external risks) on the horizon and manage them proactively. Using inputs from PESTLE/GRIC (Global, Regional, Industry and Client) analysis, the Risk Intelligence framework complements the ERM program by evaluating / analyzing the external global events that are likely to have an impact on the Company, enabling management to take informed and timely decisions.

Some of the important enterprise risks/concerns (covering strategic, operational, compliance risks) specific to the Company and steps taken by the Company to mitigate these risks are given below:

Information and cybersecurity threats are growing in complexity and magnitude, particularly those involving data breaches and compromise of information assets. These threats have become increasingly sophisticated, with cybercriminals and nation-state actors targeting IT service firms. To address these, your Company continues to maintain and enhance its robust IT security frameworks and a comprehensive Cyber Security Strategy.

Your Company is certified on ISO 27001 (Information Security), PCI DSS (for credit card processing BPO projects), and ISO 22301 (Business Continuity Management). We also undergo SOC 1 Type 2 and SOC 2 Type 2 audits annually, conducted by independent third-party auditors. In addition, the Company has obtained multiple global certifications and external validations, including HiTrust, Cyber Essentials Plus, TISAX, and CyberGRX. These demonstrate our adherence to best-in-class data security, privacy, and resilience standards applicable across clients and geographies.

Red Team Assessments and mock cyberattack simulations are regularly conducted to identify vulnerabilities and test preparedness. Any identified gaps are promptly addressed. Notably, despite the increase in cyber threats globally, the Company did not experience any cyber incidents that impacted business operations during the year.

Our refreshed Mphasis Cyber Security Strategy (MCSS) roadmap focuses on risk reduction, brand protection, and resilience. The roadmap incorporates input from clients, regulators, shareholders and consultants. A dedicated security awareness function and simulation-based training are key to strengthening employee cybersecurity culture across the enterprise.

Furthermore, the Company is currently in the process of implementing ISO 42001, the international standard for Artificial Intelligence Management Systems, to ensure ethical, secure, and compliant deployment of AI technologies in line with global best practices.

Disruptions due to natural disasters, civil unrest, or infrastructure outages can severely affect business continuity. The Company has implemented ISO 22301-certified Business Continuity Management Systems (BCMS), with defined Disaster Recovery (DR) plans for critical applications and delivery centers.

Regular DR drills are conducted, and critical business services are periodically tested for failover scenarios. Despite city-level disruptions during the year, the Company ensured seamless service delivery to its clients. Enhanced BCP and DR capabilities, combined with location- diverse infrastructure, have enabled operational resilience.

In summary, your Company remains deeply committed to identifying, assessing, and mitigating a comprehensive range of risks across strategic, financial, operational, compliance, and ESG dimensions. Our risk management philosophy balances agility with governance, enabling the business to remain resilient in the face of uncertainty and responsive to stakeholder expectations.

The integration of risk intelligence into strategic planning, use of scenario-based testing, and our commitment to emerging standards such as ISO 42001 and CSRD-aligned ESG disclosures position the Company to not only safeguard value-but also to create and amplify value in a dynamic global environment.