What Is ESG Risk Management Framework?

Knowing what is the ESG risk management framework is now an essential knowledge for those who have any role related to sustainability, compliance, risk and corporate strategy. Organisations are codifying their approach to identifying, evaluating and addressing environmental, social and governance exposures as investors, regulators and customers increasingly seek strong evidence of how companies are tackling these issues. ESG risk management has become a mainstream topic, not just a specialist field, and is now a line item in job postings across sectors that were foreign to the concept only a few years ago. Whether you are already in a career in a risk function or you want to join a career in a risk function, this article explains what an ESG risk framework is, how it relates to ESG due diligence and ESG risk strategy and what lessons can be learned from people who have actually implemented them in their practices. 

What Is ESG Risk Management Framework in Practical Terms?

An ESG risk framework is essentially a systematic process for identifying, evaluating, and mitigating risks associated with environmental, social, and governance issues. Environmental risks might include carbon emissions, water usage, or exposure to climate-related disruption. Social risks include human rights, community relations and labour practices throughout the supply chain. Governance risks are associated with oversight of the board, accountability of the Executive, anti-corruption measures, and transparency in reporting. These are not considered to be silos, but are included in a single risk register which can be accessed by the leadership in conjunction with financial and operational risks.

The key difference between a real ESG risk management program and a compliance checklist is that it is not an annual reporting exercise, but rather it is integrated into the platform for decision-making. This involves the assignment of risk owners, the identification of escalation pathways and the regular review and updating of the framework as changes to the regulations, stakeholder expectations, and business operations occur. One of the most important skills to acquire early is the ability to tell the difference between a framework that’s just a paper document and a one that’s truly functional, as it’s becoming a staple in job interviews and evaluations with employers. It’s a good first step to follow a single identified risk from the time it is identified, through assessment and escalation, to the point it ultimately affects, as weaknesses in this link are typically where a framework can quietly fail in practice. 

What Is ESG Risk Management Framework’s Relationship With ESG Due Diligence?

The practical process that a company uses to collect the data it requires to feed into its risk framework is its ESG due diligence. This is usually done during the onboarding process of a supplier, during M&A transactions, in screening investments, or periodic reviews of current business partnerships. The depth and extent of the due diligence exercise varies by the perceived risk material.The depth and extent of the due diligence exercise can vary from desktop research to self-assessment questionnaires through to on-site audit and/or third party verification. If a company procures raw materials from one of these areas, where there are known issues with labour rights, then it would typically have to carry out further diligence than a company who buys standard office furniture from a trusted domestic supplier. The depth of ESG due diligence to any given relationship should be proportionate to risk, not convenience, a principle that many organisations only apply if a problem arises with an under-due diligence relationship.

The quality of the ESG due diligence directly impacts the reliability of the overall due diligence framework, as a risk framework is only as good as the data that it is based on. This is a lesson many organisations discover the hard way when they find their self-reported questionnaires from suppliers were not thorough and accurate enough, leading to a change in preference for independent verification and continual monitoring of suppliers rather than a single assessment. One of the most transferable skills of working in an ESG related job is due diligence, such as being able to ask the right questions, check the facts and identify red flags, which is equally relevant to procurement, investment analysis and compliance. One of the more common process lessons is that the due diligence process should be a staged process; a lighter due diligence screen used with a broad cross-section of relationships, and a more comprehensive due diligence screen used with a smaller subset of relationships identified as higher risk, which maintains a balanced process that is comprehensive and not too burdensome for lean team processes. 

What Is ESG Risk Management Framework’s Role in Shaping ESG Risk Strategy?

A framework only becomes of value if it is integrated into a larger ESG risk strategy, which is used to inform and drive resource prioritisation and trade-offs. The level of materiality involved in risk, the risk level within a company’s risk appetite, and the risk which is decided against by, for example, changing suppliers or markets, or changing the way the company does business, all represent aspects of strategy. Such prioritisation is usually guided by a materiality assessment based on the likelihood, the severity, the relevance of stakeholders and the financial performance. Risks can be valued differently by different groups of stakeholders, a relationship that is low priority for a supplier could be high priority for a customer or community group, so a viable strategy process must involve stakeholders other than the finance and investor relations function.

If there’s no ESG risk strategy in place, organisations may find that they end up allocating their resources to these risks in a way that’s too broad. A robust ESG risk management function will generally review its priorities on an annual basis, taking account of the new regulations, stakeholder considerations and learning from incidents and near misses that have occurred over the last 12 months. Where an organisation differentiates between operational contributors and strategic advisors is often how they turn a long list of identified risks into a focused, resourced strategy – and it’s a skill that hiring managers are likely to test candidates on for risk or sustainability jobs. 

What Is ESG Risk Management Framework Made Up Of Structurally?

Although the terminology and tools differ from sector to sector and organisation to organisation, most effective frameworks have a similar structure to the backbone. The governance structure is at the very top with a board committee or senior executive accountable for governance. Under this is risk identification and assessment, which is commonly assisted with materiality assessments and sectoral risk libraries, to prevent starting from a blank page. The evidence is then generated by the due diligence and monitoring processes and translated as a result of the reporting and disclosure processes into a form acceptable to regulators, investors and others. A smaller organisation may think this model is only suitable for large companies, but the sophistication of the systems doesn’t vary with the size — it’s what works, not if they are required. 

The table below summarises these core structural components and their typical purpose within an ESG risk framework.

When professionals recognize the interdependence of these elements, they realize that ESG risk management is not a one-ESG tool or a one-ESG software or system; it is a system, a coordinated system that utilizes people, processes and data. One of the more common implementation challenges is to consider any one part — typically reporting and disclosure — to be the entire framework, when it is actually only the output layer atop of governance, assessment and due diligence work that must precede it for the disclosures to be believable. 

Five Key Steps to Building an Effective ESG Risk Management Framework

The following five steps are representative of the key steps most organizations take when building or refining their exposure management strategy for ESG and generally in the order in which they tend to occur in a maturing approach to ESG exposure management.

1. Prioritise and locate material risks by applying industry benchmarks and stakeholder feedback to minimise the chances of missing any material risks.
2. Ensure that there is clear accountability for every risk category and ensure that this responsibility is not spread across the organisation.
3. Implement and maintain consistent ESG due diligence procedures for suppliers, partners and investment targets based on the perceived materiality of the risk.
4. Construct monitoring and escalation routes and address issues that arise before they become major incidents or reputational events.
5. Continuously review and update the ESG risk strategy to take into account lessons learned, regulatory updates and changing expectations of stakeholders. 

Real-World Examples of ESG Risk Management in Practice

For a medium-sized food and beverage company, the discovery during a routine audit of one of its packaging suppliers’ packaging materials was sourced from a facility with ongoing labour rights issues. The company’s ESG drive was identified prior to becoming a public controversy due to its established ESD due diligence process that called for re-verification, not one-off onboarding checks. The company collaborated with the supplier on a corrective action plan with a timeframe and when the improvement was not achieved, switched to an alternate supplier. The process also led the company to look at its broader supplier network with similar criteria to identify two additional connections that would require further investigation. It provides an example of a successful ESG risk framework that requires continuous monitoring, not a one-off evaluation, and that can use a single incident as an appropriate catalyst for a wider review.

For instance, a financial services company growing its lending business into a new market identified that there was no clear process to evaluate the potential for climate-related exposure in its loan portfolio. Leadership ordered a materiality assessment, which showed that a significant proportion of proposed lending was in the development of industry sectors that are very sensitive to transition risk as the requirements were increased. This led to a refreshed ESG risk strategy which included sector-specific loan limits and further ESG due diligence criteria for certain higher risk sectors, and for the first time, the requirement for relationship managers to undergo basic ESG training before approving loans in the flagged sectors. These two examples demonstrate that ESG risk management is best when it becomes an integral part of operations and business, not a stand-alone reporting task. 

Benefits and Challenges of Implementing an ESG Risk Framework

Companies with a mature ESG risk management system generally reap returns beyond just regulatory fines. This greater transparency in risk visibility can help with better decision making, less risk of a bad surprise in the reputation and sometimes even be a benefit in access to capital, as many investors and lenders nowadays include ESG performance as part of their assessment. Practicing this skill in the workplace is beneficial for professionals, as they gain credibility in various job fields such as risk, compliance, procurement and corporate strategy, and the ability to think across several professions that employers are looking for in junior and mid-level job entries. An effective embedded framework can also reduce the time taken to act the moment there is a problem, as there are established pathways and decision makers to turn to, rather than one that needs to be negotiated under pressure.

The difficulties are just as great. Data quality is a constant challenge – especially when collecting data from suppliers or business partners that have limited reporting ability. The other frequently cited problem is what is called the ‘framework fatigue’ situation where an increasingly large number of organisations use more than one standard and tool, but lack a framework to resolve overlaps and clarify things. Similarly, resourcing is a very common tension as an ESG risk management function is expected to deliver a wide breadth of work with a smaller number of staff or in a smaller budget, and it is not uncommon for one analyst to look after an entire supply chain or an investment portfolio for an ESG risk management framework. One of the best lessons to be learned in this area is prioritisation – an ESG risk strategy that aims to do everything all at once is unlikely to be as effective as one that focuses on really what the risks are in the business and in the eyes of the stakeholders. Developing comfort in saying “not now” to lower priority issues and documenting why is a skill that is developed over time and that is counterintuitive for newer practitioners. 

Conclusion: Actionable Insights

While an ESG risk framework provides organisations with a structured approach to identifying, prioritising and mitigating environmental, social and governance risks, it is only by making ESG due diligence and a robust ESG risk strategy an integral part of the decision-making process that its true power can be realised. The obvious next steps for those seeking to pursue a career in this area are the following: Identify a process that is truly operational and not just paper, acquire good due diligence and evidence-verification capability, and practise taking long lists of identified risks and producing focused, resourced priorities. Building familiarity of the frameworks that are tested and refined over time is also important as a static framework that is not reviewed within a few years becomes out of step with regulation and reality of business. The ability to articulate an understanding of ESG risk management is becoming an increasingly valuable and transferable skill in the finance, procurement, or strategy world, and if the aspiration is to have a dedicated role within that field it is an even more valuable skill.