6 min read GRC and RiskLeadership and Work

ESG risk management has become business-critical — Here’s why

Now more than ever, the link between ESG (Environmental, Social, and Governance) and risk management has become a competitive factor for businesses.

Economic and regulatory risks on business and society result in existing and emerging social, environmental, and governance (ESG) risks. ESG is often described as a concept commonly used by investors in the capital markets to evaluate corporate behavior and assess the future financial performance of companies by measuring their sustainability. For investors, ESG refers to standards that go beyond conventional financial considerations, specifically environmental, social and governance metrics, which are used to assess potential investment opportunities based on how an organization complies with the fundamental principles of ESG. While some may view ESG as a set of factors exclusively used by socially aware investors to select potential investments, or by environmentalists to force a company to change its operations, it is becoming an increasingly common set of criteria. Evaluating a company’s behavior and policies when it comes to environmental performance, social performance and governance issues makes it critical for boards of directors to integrate ESG criteria into their core strategic discussions. And perhaps most importantly, ESG practice is becoming part of a long-term strategy, and every company needs to be backed by the support of management’s vision and plans for a sustainable future.

To increase their chances of success, winning companies must ensure that those who manage the most important determinants of ESG performance have the skills and resources to get the job done. Exemplary companies typically start by focusing their ESG activities on helpinh shift from a focus on risk and compliance to a focus on operational efficiency. ESG needs to be incorporated into the broader business strategy as well as enterprise risk management (ERM) and performance management systems. While commitment to voluntary targets and standards on issues such as climate change or tailings management is usually well-intentioned, without proper internal structures, it will be difficult for companies to make effective progress towards them. To move from commitment to action, companies need to be functionally set up to respond and consider the opportunities, challenges and risks associated with ESG factors. Moreover, the shift in environmental, social and governance (ESG) factors from conceptual and investor preferences to regulatory requirements presents challenges for risk managers, especially when it comes to integrating sustainability risk factors into existing risk management frameworks.

The EBA’s (European Banking Authority) recently published report presents a comprehensive recommendation to integrate environmental, social and governance (ESG) factors and ESG risks into the regulatory frameworks of lenders and investment firms. The report establishes consistent definitions of ESG risks and their transmission routes, as well as the evaluation methodologies required for effective risk management. EBA advises that ESG risks shall be included in corporate strategies, governance, risk management, and supervision as soon as possible. With the growing focus on ESG and the wide range of risks that need to be managed, questions about the transformative role of enterprise risk management (ERM) in helping shape an organization’s strategy are becoming more common. In consequence, many risk professionals need to adjust their strategies accordingly to ensure that ESG standards are fully integrated into an organization’s ERM. By leveraging a broad understanding of the organization and its risk profile, ERM leaders can play an active role in increasing board and senior management input into ESG considerations.

Marsh Launches ESG Risk Rating to Assess Companies’ ESG Performance

Regardless of the company size categroy, industry, or ESG score, integrating ESG factors into business decision processes is good risk management. In other words, ESG risk is a real business risk and ESG risk management should be part of a company’s standard risk mitigation practices. In terms of governance, EBA recommends that institutions integrate ESG risks into governance structures by establishing clear operating procedures and accountabilities for relevant lines of business, internal control functions, committees and governing bodies. As ESG becomes an integral part of the formal governance system, it should be included in key decision-making processes as important factors in prudential risk assessment. This may include the purpose of the ESG in relation to reputational risk, regulatory change management and governance processes. Disclosure requirements increasingly include governance policies and procedures, including the management of ESG factors. These areas include developing an ESG approach and a company’s risk appetite, integrating ESG issues into an organization, defining roles and responsibilities for ESG issues, escalating ESG risks to decision makers, ESG risk discovery and analysis, ESG risk decision making, and reporting. ESG practice includes fairly rigorous measurement and reporting of environmental, social and corporate governance activities in order to understand risks and impacts. ESG data helps companies participate in effective risk management, enabling management teams to plan compliance targets, enhanced and voluntary disclosures, and roadmaps for mitigation strategies that address threats before they occur. ESG reports can help companies move from a reactive, compliance-based mindset to a forward-looking, proactive approach to risk mitigation.

In addition to traditional profitability criteria (balance sheet and profit and loss analysis), ESG ratings are primarily used to assess a company’s sustainability performance and risk levels. ESG ratings and the information used to calculate the scores provide investors and executives with the tools to assess a company’s ESG performance and manage risk. ESG-enabled metrics can be used to create individual scores (by applying custom weights) or to explore specific company strengths and risks. While not all ESG metrics can have a direct impact on a company’s profitability, they all affect reputation and can indicate a lack of long-term risk appetite or potential regulatory risk.

Integrating an ESG framework into business operations and processes can help ensure a company’s long-term success by taking steps to reduce these risks. By applying traditional risk management principles to ESG risk management, such as implementing appropriate controls and ensuring that all communications are accurate and transparent, companies can better deliver on their values, respond quickly to threats, and prepare for upcoming regulatory action. With a clearer understanding of ESG risks, companies can better allocate resources, address rising operating costs, improve employee retention and comply with regulatory requirements. The benefits for companies that take an active role in developing their ESG approach will not only help mitigate reputational risk for their organization and manage societal expectations, but will also help them benefit from understanding the financial benefits of clients with high ESG scores. Integrating resilience into ERM can improve a company’s understanding of the entire set of risks, improve resilience management, and improve overall business performance. The way a company manages its environmental risks and regulation is especially important for assessing risks and ensuring the sustainable economic growth of the business, especially in energy and resource-intensive sectors. As risk managers, insurers and investors, the insurance sector plays an important role in promoting economic, social and environmental sustainability or sustainable development.

Companies will need to report on all ESG matters, so if ESG risk management is included as an important part of the ERM strategy, disclosure of this information to the relevant governing bodies should be much easier, which will help reduce legal intervention. In particular, make sure that the board level is getting the right information so they can provide management oversight and ultimately give executives the right direction on how to address ESG issues. ESG risk committees are usually part of, or already part of, the formal governance structure, and while they can be helpful, it is important to ensure that these groups do not exist in isolation.


Cited sources

Originally published

Related reading

Leadership and Work

Growth and resilience in the year of the polycrisis
GRC and Risk

ISMS: People, processes and technology are essential
GRC and Risk

Managing risk capability in financial organizations

Let us talk

Looking for a marketing leader who understands trust, technology and growth?

Keynotes, panels, podcasts, advisory conversations and partnership ideas. I answer personally, usually within a working day.

Write me an email LinkedIn