Self Assessment Tool - Risk Management

Just starting out

• Assess whether the governance process around sustainability-related risk identification, assessment and management sufficiently sets out responsibilities for driving progress.
• Adopt a collaborative approach, with finance teams working with risk and sustainability teams as appropriate, and inputs from wider organizational representatives such as asset managers and procurement specialists. 

Looking to improve

• Review the accountability for sustainability-related risks and ensure this is aligned with your wider risk governance. For example, the extent to which your risk governance is centralized or decentralized.
• Engage with executive-level personnel to ensure there is support for creating sufficient capacity within the relevant teams (including finance, sustainability and risk), so that they can allocate time and resources to sustainability-related risk identification, assessment and management and can support the collaborative approach needed.

Moving to a leading position

• Consider whether, for sustainability-related risks, the organization’s risk appetite and risk tolerance are aligned with the wider organizational approach to risk management. Determine whether there is sufficient expertise and knowledge at executive level to allow for informed decision making across a range of organizational risks.
  

Just Starting out

• Consider the method by which sustainability-related risks are identified and whether there is sufficient input from specialists and those with broader business knowledge to enable your organization to identify key dependencies and impacts, and the risks along the full value chain.
• Assess the level of knowledge of sustainability-related risks within the risk team and their ability to support in risk identification. Identify and close gaps through training, or by ensuring there is sufficient capacity within the team to develop knowledge internally. 

Looking to improve

• Develop an internal process for incorporating the input of wider groups with suitable expertise and understanding, such as sustainability professionals. Consider how such external challenge and input could be obtained.

Moving to a leading position

• Liaise with a range of your key stakeholder groups – such as government, NGOs, suppliers, industry bodies, customers and employees – to gather a range of views as part of the sustainability-related risk identification process.
• Consider the interdependencies between the sustainability-related risks identified and wider organizational risks. For example, physical climate risk could increase the risk of project delays. Consider whether your current risk management system captures these interdependencies effectively. 

Just Starting out

• Consider the time horizons over which you assess risk and ensure these are appropriate (as a minimum, for example, these time horizons should align with your longer-term business strategy). 

Looking to improve

• Assess whether your time horizons should be extended to align with the lifespan of assets or investment holdings and with longer-term targets such as net zero ambitions. 

Moving to a leading position

• Consider ecological timelines and crucial dependencies, as well as specific considerations for your industry and sector (within the context of wider government ambitions, for example).

Just starting out

• Consider wider risk assessment processes and determine how to integrate sustainability-related risks into them. This could include using comparable thresholds and criteria to determine materiality, impact or likelihood.
• Use different business functions to support knowledge sharing when considering the impact of sustainability-related risks on the organization, to ensure there is sufficient understanding within the teams responsible to document and review the outputs of the assessment.
• Engage with external experts (such as sustainability consultants) to support and enhance knowledge where required. 

Looking to improve

• Consider the frequency of assessment for sustainability-related risks and assess whether this is sufficient or whether you could use different approaches for different levels of risk. For example, regulatory reviews may take place more frequently than assessments relating to the long-term impacts of climate change.
• Ensure that sustainability-related risks are assessed using scenario analysis over the short-, medium- and long-term time horizons that are relevant for your business. 

Moving to a leading position

• Develop a methodology for understanding the scenario sensitivity, probability of occurrence and confidence levels around the data, to ensure any uncertainty around the assessment is clearly understood by decision makers.
• Recognize that additional criteria may be required to assess sustainability-related risks, such as speed of onset and vulnerability of the organization, and build these criteria into assessment processes where possible. 
• Develop rigorous processes around the financial quantification of risks, ensuring that meaningful data is used to support risk assessment. This could include calculating value at risk. Periodically reassess the financial information and ensure comparability across time periods. 

Just starting out

• Consider the sustainability-related risk mitigations in your risk management framework and ensure that these are documented within the framework. Use support from individuals within the wider organization to enhance knowledge of the sustainability-related risk. 

Looking to improve

• Develop an understanding of the potential financial implications of managing risk – for example, the need to make investments in order to meet regulatory decarbonization requirements. 

Moving to a leading position

• Ensure that the governance process supports the review and consideration of risk identification, assessment and management processes to highlight the strategic implications and allow integration of sustainability-related risks into wider corporate strategy. 

Looking to improve

• Consider the sustainability-related risk mitigations in place, or actions to realize opportunities and ensure that these are documented within your risk management framework, using support from individuals within the wider organization closer to the risk or opportunity identified to enhance knowledge of the risk or opportunity.
• Ensure that the governance framework supports the review and consideration of risk identification, assessment, and management processes at business leadership level, to ensure that strategic implications can be understood and weaved into wider corporate strategy.

Moving to a leading position

• Develop an understanding of the potential financial implications of managing risk (for example, investments required in order to meet regulatory decarbonization requirements).
  

Just starting out

• Assess whether it is suitable to incorporate sustainability-related risks into your current risk management framework. For example, in many cases climate-related risks, such as the increased risk of storms and flooding, will be an exacerbator of an existing risk, such as the risk of supply chain disruption.
• Enhance the interconnectivity and interdependence of different risks within your framework – for example, by incorporating some climate-related risks as a ‘risk drivers’ for existing risks.

Looking to improve

• Centralize risk management processes and responsibilities, as appropriate for your organization, so that the overall responsibility for identifying and managing all risks, including sustainability-related risks, is within an overarching risk management framework. Ensure there is strong connectivity between different teams to allow efficient flow of information and consult with external stakeholders to support with this process where relevant. 

Moving to a leading position

• Assess whether your internal control framework is aligned with the processes to manage sustainability-related risks. For example, you can ensure that sustainability data is subject to the same level of internal control as other kinds of data and the controls over sustainability data are included within the internal audit planning processes.