This matters because the way ESG risk gets managed when it is treated as a sustainability communications exercise tends to produce poor outcomes: inconsistent identification, superficial assessment, limited board visibility, and an inability to demonstrate to regulators or investors that the risks are genuinely understood and managed.
Why ESG Risks Belong in the Risk Register
The Financial Materiality Case
The argument for treating ESG risks as genuine enterprise risks is primarily empirical. These risks have material financial, operational, and regulatory consequences that belong in the same conversation as other risks the board oversees.
Climate risk is the clearest example. Physical climate risks, including flooding, extreme heat, and severe weather, affect operational assets, supply chains, and insurance costs in ways that are directly financially material. Transition risks, arising from regulatory change, technology shifts, and changing market preferences as economies decarbonise, affect revenue, capital costs, and stranded asset exposure across a wide range of sectors.
The Task Force on Climate-Related Financial Disclosures frames climate risk explicitly within standard financial risk categories, physical risk and transition risk, each affecting strategy, operations, and financial position. Regulators including the FCA and the PRA in the UK have followed TCFD in requiring financial institutions to disclose climate risk within these financial risk categories.
Beyond Climate
Social risks, including human rights violations in supply chains, labour disputes, data privacy failures, and community opposition, carry regulatory, reputational, and operational consequences that belong in the risk register. Governance risks, board failures, corruption, inadequate controls, have a well-documented history of producing significant financial losses.
ISO 31000's principle that risk criteria should reflect the organisation's specific context applies directly: material ESG risks should be assessed using the same methodology as other material risks rather than through a separate sustainability scoring approach that cannot be compared to operational or financial risk ratings.
Step 1: Identify Material ESG Risks
Using Double Materiality as the Identification Framework
The double materiality framework, which assesses both how ESG factors affect the organisation financially and how the organisation's activities affect the world, provides a useful structure for identification. For risk management purposes, the financial materiality dimension is the most immediately actionable: which environmental, social, and governance factors could materially affect the organisation's financial position, operational capability, cost of capital, or regulatory standing?
This identification exercise must be cross-functional. Finance, operations, legal, procurement, HR, and risk functions all hold relevant information about where material ESG risks sit in practice. A sustainability team working in isolation will miss risks visible only from operational or commercial perspectives.
Sources for Identification
Useful sources for identification include the organisation's sector risk landscape, the material topics flagged by ESG rating agencies and peers' sustainability reports, regulatory guidance on climate and sustainability risk, and the ESG assessment outputs from due diligence on suppliers and business partners.
Step 2: Assess Likelihood and Impact
The Distinctive Characteristics of ESG Risk Assessment
ESG risks share the likelihood and impact assessment methodology applied to other risks, but have some distinctive characteristics that affect how assessment works in practice.
Time horizons. Climate risks in particular play out over longer timeframes than most operational risks. Physical climate risks may be most significant over ten or twenty year horizons. Risk assessment must consider forward-looking scenarios rather than relying purely on historical data that may not reflect the emerging risk environment.
Scenario analysis. For climate risk specifically, scenario analysis has become the expected practice under TCFD and, for larger financial institutions, a regulatory expectation. The COSO ERM Framework identifies scenario analysis as a core component of risk assessment for uncertain, forward-looking risks. Scenario analysis involves testing the organisation's exposure under different future states, including both low-warming and high-warming pathways for climate risk.
Interconnection. ESG risks rarely materialise in isolation. A major climate event simultaneously affects operations, supply chains, and insurance costs. A regulatory change driven by sustainability policy simultaneously creates compliance risk, transition cost, and potentially market risk. Assessment should reflect these interconnections.
Step 3: Integrate Into the Risk Register
Same Register, Same Language
ESG risks that have been identified and assessed must be integrated into the organisation's central risk register, not maintained in a separate sustainability register with limited connection to board oversight. This integration requires expressing ESG risks in the same language and rating scales used for other risks, so they can be prioritised alongside operational, financial, and compliance risks.
Risk Ownership
Each ESG risk needs a named owner with genuine accountability for management. A risk "owned" by the sustainability function without operational authority to manage the underlying exposure is not adequately owned. For climate risk in particular, ownership needs to sit with the people who control the assets, processes, or decisions through which the risk is actually managed.
Connecting Controls to ESG Risks
Controls that manage ESG risks, including emissions reduction programmes, supply chain audit processes, and governance frameworks for climate risk oversight, must be documented and tested with the same rigour applied to controls in other risk areas. The gap between ESG risk ratings and ESG risk controls is an area where ESG risk management frequently fails its own standard: residual risk ratings assume controls are working without independent verification.
Step 4: Report to the Board
Board Accountability for ESG Risk
Board-level oversight of ESG risk is expected by regulators and investors. TCFD specifically requires disclosure of how the board oversees climate-related risks and opportunities. The FCA's expectations for regulated firms extend this to broader ESG governance. Board members need both the information to exercise oversight and sufficient understanding of ESG risk to engage meaningfully with that information.
What Board ESG Risk Reporting Should Cover
Effective board reporting on ESG risk covers the organisation's most significant ESG risks and how they have changed, the controls and management actions in place, progress against relevant targets and commitments, the outcomes of scenario analysis and stress testing for climate risk, and any emerging ESG risks on the horizon.
This reporting should be integrated into the board's main risk reporting rather than presented separately as a sustainability update. Separate treatment signals that ESG risk is supplementary rather than central to the board's governance responsibilities, which is increasingly inconsistent with regulatory expectations.
Step 5: Build the Data and Control Infrastructure
Why Data Quality Matters
Managing ESG risk credibly requires data of sufficient quality and completeness to support the assessments on which governance decisions are based. Not data assembled shortly before a disclosure deadline, but data collected, validated, and used continuously throughout the year.
Building this infrastructure covers greenhouse gas emissions measurement across all three scopes, supply chain data collection for Scope 3 and for social metrics, governance and compliance data covering ethics and audit outcomes, and controls management for the controls managing material ESG risks.
Connecting to CSRD
For organisations within CSRD scope, the data required for ESG risk management and the data required for CSRD reporting have substantial overlap. Building a single data infrastructure that serves both purposes is considerably more efficient than building separate programmes for risk management and disclosure. The data quality standards required for CSRD external assurance are also the data quality standards needed for credible board-level ESG risk reporting.
References and Further Reading
