How ESG Cultivates a New Paradigm in Risk Management

A lack of roles, responsibilities and adequate capabilities can lead to inconsistent and uncoordinated risk management processes across the organization especially when it comes to the integration of ESG aspects

Therefore companies need to review their governance structure for alignment with stakeholder expectations and establish an integrated Risk Appetite Framework incorporating expertise from relevant functions (such as sustainability teams). With that streamlining the Risk Management Taxonomy and methodology can be assured. This needs to be backed up by relevant documentation such as policies, procedures, and RACI matrices to govern ESG risks relating roles and responsibilities

A double materiality assessment evaluates both how sustainability risks impact a company's finances and the effect the company's activities have on society and the environment. By facilitating future planning and risk management, strengthening accountability to stakeholders, society and the environment, and providing information for strategic decision-making, it becomes a critical element of the company's sustainability plan.

Assessing double materiality comprehensively can be resource-intensive and requires specific expertise and benchmarks. Companies might lack the necessary resources or prefer to allocate them to core business activities. At the same time, organizations can struggle to integrate the outcome of a double materiality assessment into an existing business strategy and (risk management) processes.

To progress in this area, organization’s need a detailed picture of their business practices and operations along its value chain. External expertise of validated frameworks and methodologies can be helpful in conducting a comprehensive double materiality assessment.

Third-party risk management has become more important due to ESG aspects because a business's ESG risks can extend to its partners, suppliers, and other affiliated third parties, potentially impacting the business's overall sustainability and reputation. By adopting robust third-party risk management, businesses can better control these risks, align operations with their ESG objectives and ensure that their business practices meet regulatory, ethical, and social standards.There is often no single ownership and transparent inventory of third-party relationships, which is a breeding ground for potential gaps and overlaps in risk management activities.

Considering this, we recommend the creation of risk assessments, surveys and screenings from vendors that can be used in combination with control frameworks and regulations. For that it is important to create transparency and centralize the data sets of third-party providers to get a consistent perspective on the risk profile and assessment data.  Technology-enabled solutions support automated due diligence, continuous monitoring and analysis of opportunities and threats.

Many companies apply an ad hoc and siloed approach to internal controls in the ESG context, without applying common frameworks and metrics. This approach brings the risk of gaps or errors at a time when stakeholder expectations are rising and confidence in ESG disclosures is critical.

A readiness assessment will help organizations to evaluate their internal control framework and create a roadmap from an ESG perspective. Effective policies and controls are key to support the integration of ESG matters into its control systems, including the design of related business and IT controls. Companies may also like to consider getting attestation services for assurance on key ESG metrics and reporting.

Leading internal audit functions provide a strategic partnership to an organization's ESG programs - providing proactive insights and assurance to increase confidence in managing ESG risks, measuring and reporting progress, and achieving defined ambition and targets. 

A comprehensive analysis will help businesses to understand ESG gaps in their internal audit function. This should cover internal audit ESG awareness, capabilities and capacity. The goal is to achieve an integrated approach across all related functions and three lines of defense. Investing in external expertise with a focus on ESG Risk Management can be a quick and efficient way to get a businesses’ internal audit function where it should  be.

Faced with the need to run a transformative ESG program, organizations may struggle for various reasons, including lack of stakeholder buy-in, higher ESG program costs and challenges around realizing the intended benefits.

Risk, quality, benefit and performance management are the foundational focus areas to help  management make well-informed decisions,increase stakeholder buy-in and ensure a successful implempentation.

In a first step, companies should review their ESG transformation program and perform a feasibility analysis based on best practices and benchmarks. Working from this basis,  a roadmap for the program, including immediate mitigation measures for identified risks and a plan to realize benefits can be created

Technology based enablers can be a valuable addition to an organization’s ESG governance risk and control landscape – but only if they enhance existing capabilities. Otherwise, they can be an additional burden and worthless investment for the organization and governance. 

To derive value from technological enablement, it is important to first define technical and business requirements. If in-house expertise to do this is not available, seek external support to guide you through vendor selection process and manage the process of tool implementation and roll-out. As with any new technology, user trainings are essential to get personell up to speed quickly and support them on the change journey.