As environmental, social, and governance (ESG) factors impact business viability more than ever, traditional Enterprise Risk Management (ERM) frameworks must evolve to incorporate sustainability risks.
The Shift from Compliance to Strategic Risk
Historically, ESG risks were managed in corporate silos as compliance or public relations tasks. However, developments such as carbon taxation, supply chain human rights audits, and climate-induced extreme weather events demonstrate that ESG issues present direct financial and operational risks.
How to Embed ESG into ERM
- Establish Governance and Culture: Align risk appetite statements with sustainability targets, and ensure the board oversees critical ESG risk thresholds.
- Identify and Assess Risks: Map sustainability issues (such as water scarcity, cybersecurity, and regulatory updates) alongside standard commercial and financial risks.
- Implement Mitigation Strategies: Set up response plans, including diversifying suppliers, upgrading facilities for climate resilience, and implementing anti-bribery measures.
- Continuous Monitoring and Reporting: Report key risk indicators (KRIs) regularly to the Risk Management Committee and the Board.
Role of Internal Controls
Independent reviews and internal audits are critical in validating the reliability of risk management systems. Reviewing controls over ESG metrics ensures that management reports present a true and fair view of the organization's risk profile.
