Risk management has a reputation for being the dull part of the job. But at its best, it is about seeing what others miss: the shifts in climate, nature, supply chains, regulation and customer expectations that change a business before they show up in the numbers. And behind many of those risks sits an opportunity.
The IFRS S1 and S2 ask how a company identifies, assesses, prioritises and monitors its sustainability-related risks, and whether that process is part of how it manages all its risks. They also ask how the same process helps the company find opportunities, not only threats.
This article looks at what wasn't working, what the risk management pillar is designed to fix, three questions to test where you stand, and five practical steps to embed sustainability in your risk management.
What wasn't working: listed, filed, forgotten
In many organisations, sustainability risks were identified by one team and kept apart from the risks that drive day-to-day decisions. They were acknowledged, written down and then rarely acted on.
Five patterns come up again and again:
Separate lists and scoring methods. Sustainability risks were assessed on their own scale, so they could never be compared with other business risks.
No clear owner for each risk. Everyone knew the risk existed, but nobody was responsible for managing it.
Supply chain exposure left out. The assessment covered the company's own operations, while much of the real exposure sat with suppliers and customers.
Reviewed once a year, if at all. Risks that can change quickly were only looked at when the annual report was due.
Opportunities never assessed. The process looked for threats only, so new markets, products and efficiencies went unnoticed.
What the Risk Management pillar is designed to fix
The pillar asks you to bring sustainability risks into the risk framework you already use. If a risk can affect the value of the business, it belongs alongside every other risk that can.
You don't need a new system. It's a journey:
Start: add the most material sustainability risks to your enterprise risk assessment.
Build: score them the same way as other risks, and name an owner for each.
Embed: extend the assessment to your value chain and review it regularly.
Each step builds on what you already have, rather than adding another process to maintain.
Three questions to test your Risk Management
How do you know whether sustainability risks are truly managed, or just listed? These three questions are a quick, honest check.
1. Is sustainability scored like any other business risk?
It doesn't need its own process. It needs a place in the one you already have. When sustainability risks are scored on the same scale as financial, operational and regulatory risks, they compete for attention on equal terms.
2. Who owns each material risk, and do they have the authority and budget to act?
A risk without an owner is a risk nobody is managing. And an owner without the authority or budget to act can only watch it grow.
3. Does your risk assessment cover your supply chain and value chain, or only your own operations?
For many companies, the biggest exposure sits outside their own walls: in raw materials, suppliers, logistics and customers.
Three honest "yes" answers suggest sustainability is embedded in your risk management. One or two means you are on the way. None means it is time to start, and that is a starting point, not a failure.
Five steps to embed sustainability in your Risk Management
IFRS S1 asks companies to explain how they identify, assess, prioritise and monitor sustainability-related risks and opportunities, and how these processes are integrated into overall risk management. These five steps turn that into action:
Use one process. Identify and assess sustainability risks with the same process and scoring as other enterprise risks.
Prioritise them alongside other risks. Rank them against financial, operational and regulatory risks, not in isolation.
Assign owners. Name an owner for each material risk, with a clear route to escalate.
Look beyond your own walls. Cover suppliers, customers and the wider value chain, starting with the most exposed.
Monitor, and look for opportunities. Review regularly, and use the same process to spot opportunities, not only threats.
The standard asks you to describe how these processes work, not to follow one fixed model. What matters is a credible, integrated process you can explain clearly.
Where to go from here
Risk management is where sustainability stops being a list and starts shaping what the business does next. Seen early, a risk can be managed. Seen early enough, it can become an opportunity.
Next in this series: Metrics & Targets, and whether your numbers drive decisions or just fill a report.
Futuro Advisory helps companies move from compliance to sustainability that is embedded in decisions. Book a conversation to find out where your risk management stands.
Greetings,
Anna Håkansson
Founding Director