ESG Training InstituteVisit Website →
← Back to blog

Enterprise Climate Risk: 5 ERM Steps for Risk Leaders

October 16, 2026
Enterprise Climate Risk: 5 ERM Steps for Risk Leaders

Enterprise climate risk is the combined financial and operational exposure that physical hazards, transition pressures and macro-financial shocks create for your business, and it belongs inside your ERM framework now. Use scenario analysis and governance aligned with NGFS scenarios, IFRS S2 and ISO 14090/14091 guidance. The sections below turn those standards into concrete steps your teams can assign this quarter.

TL;DR:

  • Test at least one orderly, one disorderly, and one high warming pathway; model physical and transition effects separately, then together, across decision relevant horizons.
  • Pilot one business unit in one region with two scenarios; assign named owners, produce results in existing risk formats, and deliver findings to the board.
  • Use georeferenced asset data, combine local hazards such as heat and drought, and report scenario results as ranges rather than single point estimates.
  • Start IFRS S2 control design before the reporting year, since internal controls often need 12 to 18 months to adapt; confirm local rules separately.
Esgtraininginstitute
Build stronger climate risk capability
Develop ESG skills through standards-aligned training in climate strategy, helping risk leaders strengthen their approach to climate risk.
Explore ESG training

Table of Contents

What enterprise climate risk looks like in an ERM taxonomy

Risk teams need a taxonomy they can map to business units before anything gets modeled. Climate exposure splits into two families, and a third layer explains how both reach your balance sheet.

  • Acute physical risk: floods, wildfires, storms and heatwaves that interrupt operations or damage facilities.
  • Chronic physical risk: sea-level rise, sustained heat and water stress that erode asset values and productivity over years.
  • Policy and legal risk: carbon pricing, disclosure mandates, litigation and contract liability.
  • Technology and market risk: shifting customer demand, stranded assets and the cost of switching to lower-carbon inputs.

The two families do not stay separate. The NGFS guide to climate scenario analysis describes climate risks transmitting through macro-financial channels, meaning credit, market and operational risk, and says they should be integrated into enterprise risk management rather than handled as a standalone compliance exercise. Practitioner guidance also warns of a "double hit": a delayed transition produces abrupt policy corrections at the same time as accumulated physical damage.

For mapping, think in concrete terms: a coastal distribution center (acute flood), a supplier in a water-stressed region (chronic), a high-emitting product line facing carbon costs (policy), a lender whose borrowers sit in exposed geographies (credit).

Why climate risk matters to ERM, finance and boards

Directors and CFOs do not buy "climate" as a topic. They respond to cash flow, capital and liability. Climate shocks translate into all three. A flooded plant is a business-interruption loss. A repriced asset class is a market loss. A supplier failure is an operational loss that can become a reputational one when customers and investors notice.

Reporting pressure has raised the stakes. IFRS S2 requires entities to disclose climate-related risks and opportunities that could reasonably be expected to affect their prospects, and to use climate-related scenario analysis, commensurate with their circumstances, to assess climate resilience. That makes scenario work a disclosure input, not an optional research project.

IFRS S2 expects scenario analysis to assess climate resilience, commensurate with the entity's circumstances. Source: IFRS S2. The practical meaning: your scenario exercises must be defensible enough to support external statements.

For leaders who want the financial case laid out by risk type, our analysis of physical versus transition risk walks through the financial channels in detail.

Scenario analysis: how to choose and run NGFS-aligned exercises

The NGFS recommends testing across several scenarios, for example Net Zero 2050, Delayed Transition and Current Policies, because no single pathway covers the range of risk profiles you could face. Its Phase V update models acute physical risk at the country level and uses new damage functions for chronic risks, which points to material impacts by 2030 under several scenarios.

A workable exercise follows this sequence:

  1. Set objectives and materiality. Decide which decisions the exercise informs: capital allocation, site selection, disclosure or stress testing.
  2. Choose scenarios and horizons. Pair at least one orderly, one disorderly and one hot-house pathway, and select near, medium and long time frames.
  3. Run both channels. Model physical and transition effects separately, then together, so the double hit is visible.
  4. Interpret and stress. Translate outputs into losses, cash-flow effects and capital or operational constraints your ERM team already understands.

Horizon choice deserves care. Short horizons (to 2030) fit operational planning and insurance renewal; longer ones fit asset life and strategy. Prioritize the horizon that matches the decision, not the one that produces the most dramatic chart.

Pro Tip: Start with business lines whose assets have long lives. Long-lived assets expose scenario differences fastest and give you a pilot worth presenting to the board.

A five-step ERM playbook to embed climate risk

Treat climate risk as another risk type to identify, measure, control and report. The playbook below fits inside existing ERM cycles. Our fuller five-step ERM playbook maps IFRS S2, NGFS and TCFD to each task.

  1. Scope materiality and objectives. Choose the business lines, geographies and time horizons that carry the most exposure.
  2. Map exposures. Document assets, facilities, supply chain nodes and counterparties, using geospatial data where location drives the hazard.
  3. Quantify through scenarios. Produce loss distributions, tail-risk estimates and stress outputs in formats ERM already consumes.
  4. Embed controls and capital planning. Set monitoring KPIs, assign first-line owners and give second-line functions oversight authority.
  5. Operationalize reporting and escalation. Connect outputs to IFRS S2 disclosures and to your risk appetite statements, with a defined route to the board.

A pilot keeps this manageable. Pick one business unit, one region and two scenarios, and set deliverables for each step:

  • A short exposure register with named owners.
  • A scenario results pack in the same format as other stress tests.
  • A first board paper stating findings, gaps and the next scope expansion.

For teams that need a structured method to link these steps to control frameworks, our ESG risk assessment aligns with EBA and COSO expectations.

Governance and systemic risk principles: who owns what

Ownership failures sink more climate programs than modeling failures. The three-lines model gives you a ready structure.

  • First line: business units and operations own exposures, collect asset and supplier data, and run day-to-day controls.
  • Second line: risk and sustainability functions set methodology, challenge assumptions, define appetite and aggregate results.
  • Third line: internal audit tests whether scenario processes, data and disclosures hold up.

Climate risk is also systemic, so governance has to extend past the organization. Research from the Stockholm Environment Institute and the IPCC recommends polycentric governance, with diverse internal stakeholders and external oversight. In practice, that means principles such as participation, accountability, attention to equity and adaptive review cycles, along with coordination across sectors for transboundary risks like shared supply corridors or regional water systems.

Risk appetite is where governance becomes measurable. Practical guidance on defining and applying appetite, even from the information security field, such as this risk appetite walkthrough, shows how to turn qualitative tolerance into metrics and thresholds that second-line teams can monitor.

Pro Tip: Write climate risk ownership into role descriptions and committee charters, not just into a policy document. Named owners with escalation rights are what keep exposure registers current.

Data and modeling considerations

Model quality depends on three choices: location, hazard combination and time horizon. Resilience planning needs asset-level, georeferenced data because floods, heat and wildfire act on specific sites, not on national averages. Compound hazards, such as heat paired with drought or storm surge paired with heavy rain, can hurt far more than any single event.

Common pitfalls to avoid:

  • Relying only on macroeconomic models that cannot see site-level vulnerability.
  • Treating hazards one at a time and ignoring how they combine locally.
  • Using time horizons that do not match asset life or the decision being made.
  • Hiding uncertainty by presenting a single point estimate instead of a range.

For sourcing, start with what you already hold: insurance schedules, property registers, supplier lists and incident logs. Add specialist hazard providers where internal data runs out. Commission bespoke geospatial analysis only for sites or counterparties that dominate your exposure, since that work costs the most and pays back where concentration is highest. ISO 14091 offers guidelines for assessing vulnerability, impacts and risk, and suits organizations of any size or type.

Metrics, targets and IFRS S2 disclosure implications

IFRS S2 is organized around governance, strategy, risk management, and metrics and targets, with scenario analysis scaled to the entity's exposure. Industry-based guidance derived from SASB helps identify sector-specific topics and metrics, and the IFRS basis for conclusions explains that this guidance is supportive rather than mandatory.

A practical metric set includes:

  • Exposure maps showing share of assets or revenue in high-hazard locations.
  • Resilience KPIs such as recovery time targets and share of critical sites with adaptation plans.
  • Financed emissions where your business lends or invests.
  • Scenario outputs shown as ranges, never single values.
  • Internal carbon price or capital allocated to adaptation, where used.

Plan the timeline early. IFRS notes that many organizations struggle to move from SASB-based reporting to IFRS S2, and internal controls often need "a 12–18 month lead time" to adjust to updated requirements.

Internal controls often need 12–18 months to adapt to updated IFRS S2 requirements. Source: IFRS. Start control design before the reporting year begins, not during it.

How to engage stakeholders on climate risk

Climate risk communication fails when every audience receives the same message. Tailor it by what each group must decide.

Boards need exposure in financial terms, the range of outcomes, and the decisions being requested. A one-page summary with scenario ranges and a clear ask works better than a technical appendix.

Investors and lenders look for consistency between strategy, risk management and numbers. Align your narrative with IFRS S2 structure so analysts can compare it with peers.

Employees and operations teams hold the data you need. Explain why asset and supplier information is requested and show how results change their budgets or site plans.

Suppliers, insurers and communities share your exposure. Ask suppliers about site hazards, talk to insurers before renewal about your resilience measures, and engage local authorities on shared infrastructure.

Three habits keep communication credible. State uncertainty openly and show ranges. Report progress against stated targets, including misses. Keep one owner accountable for external statements so messages do not diverge between the annual report, investor decks and sustainability pages.

Training matters here as well, because the people drafting and challenging these messages need a common vocabulary across risk, finance and sustainability.

Tools and technologies for identification and monitoring

Tools should follow the process, not lead it. Once your scope and exposure register exist, technology speeds up the repetitive parts.

Geospatial hazard platforms overlay asset locations on flood, heat, wildfire and storm layers, and are the most direct way to identify site-level exposure.

Scenario modeling software applies NGFS-style pathways to financial statements or portfolios, producing the loss and cash-flow outputs ERM teams need.

Risk registers and GRC platforms hold climate exposures next to other enterprise risks, with owners, controls and status, which supports second-line challenge.

Data pipelines and dashboards pull meter, supplier and incident data into monitoring KPIs so reviews rely on current numbers instead of annual spreadsheets.

Remote sensing and sensor networks give early warning for physical hazards and verify conditions at remote sites.

Selection criteria worth applying: transparency of methodology, ability to export results in your ERM format, support for ranges rather than point estimates, and clear data lineage you can show an auditor. A tool that cannot explain its assumptions will not survive assurance, however polished its interface. Pair tool adoption with trained staff, because software does not decide materiality or challenge a suspicious result.

Linking climate risk management to financial performance and resilience

Climate risk management pays through avoided losses, steadier operations and better-informed capital allocation. The mechanism is straightforward: when exposure is visible, you can price it, insure it, reduce it or decide to exit it.

Look for the connection in four places.

Cost of capital and insurance. Lenders and insurers increasingly ask about resilience measures. Documented exposure data and adaptation plans support better conversations at renewal and refinancing.

Operational continuity. Sites with tested continuity plans and diversified suppliers recover faster. Recovery time is a financial variable because every day of downtime has a cost you can estimate.

Capital allocation. Scenario outputs show which investments hold value across pathways and which depend on one outcome. That evidence improves capex decisions.

Revenue resilience. Customers shifting toward lower-carbon products create opportunity as well as risk, and scenario work shows where.

ISO 14090 and ISO 14091 give structure here: ISO 14090 covers the adaptation cycle from pre-planning through impact assessment, planning, implementation, monitoring and reporting, while ISO 14091 focuses on the risk assessment component. Tie each adaptation action to a measurable financial or operational indicator, and review results in the same cycle as other performance reviews. For a framework built around leader decisions, see our practical climate risk management guide.

Stages in the ISO 14090 adaptation cycle

Regulatory frameworks and compliance beyond IFRS S2

IFRS S2 is a global baseline, not the whole compliance picture. Adoption is jurisdiction-specific: some regulators have incorporated the ISSB standards into law, others use their own frameworks, and some rely on voluntary use. Treat any country's requirements as that country's requirements, and confirm what applies to each legal entity you operate.

Beyond IFRS S2, expect several layers:

  • Regional sustainability reporting rules, such as the European Union's ESRS under its corporate sustainability reporting regime, which carry their own materiality approach and detail.
  • Prudential and supervisory expectations for banks, insurers and asset managers, including climate stress testing and risk management requirements set by financial regulators.
  • Climate-related disclosure from earlier frameworks, notably TCFD recommendations, which many regimes built on and which remain a useful structure.
  • Carbon pricing and emissions regulation, which drive transition exposure directly.
  • Litigation and consumer protection rules governing environmental claims.

A practical approach is to build one internal climate risk dataset and map it to each regime, instead of running separate processes per rule. Keep a regulatory register listing each requirement, the entity it covers, the owner and the deadline. Review it quarterly, because rules continue to change. Where scope is unclear, seek legal advice for the relevant jurisdiction rather than assuming one regime's definitions apply everywhere.

The role of climate risk in strategy and investment decisions

Strategy is where climate risk stops being a reporting topic. Scenario results should change decisions: where you build, what you buy, which products you scale and how long you hold assets.

Use these questions in planning cycles:

  • Does this investment still meet its return threshold under each scenario, or only under one?
  • What is the asset's useful life relative to the hazard timeline for its location?
  • Which cost assumptions, such as energy, carbon, water or insurance, change materially across pathways?
  • Is there a lower-exposure alternative that delivers a similar outcome?

Embed the answers in capital approval templates. A short climate section on each major proposal, covering location hazard, scenario sensitivity and adaptation cost, makes the analysis routine and puts it in front of decision-makers at the moment it matters.

Strategic planning also benefits from options thinking. Where uncertainty is high, staged investments, modular designs and flexible contracts let you adjust as the transition path becomes clearer. The NGFS scenario set is useful precisely because it shows how widely outcomes can diverge, which argues for strategies that hold up across several futures instead of optimizing for one. Link these planning choices back to your risk appetite so strategy and risk management tell the same story.

An editorial view: three priorities for risk leaders

Most programs stall because they try to cover everything at once. Pick three moves this quarter. First, scope your material exposures and name an owner for each. Second, launch a small NGFS-based pilot on one business unit, and finish it. Third, set a board reporting cadence so findings reach decision-makers regularly, not once a year. Behind all three sits capability: processes only run as well as the people operating them, so invest in training early.

— Ransford

How we help you build climate risk capability

Our training pathways turn the playbook above into skills your team can apply. The Certificate in Climate Risk Management is priced at $149. For practitioners who lead enterprise programs, the Certified Climate Risk Professional (CCRP) at $349 provides an advanced credential. Teams can progress from foundation to professional to certified level, and our All-Access CPD Pass at $599 per year supports continuing development on IFRS S2 topics. Explore syllabi and corporate training options on our course catalog, and start by choosing the pathway that fits your pilot team.

Esgtraininginstitute

FAQ

What are examples of enterprise risks?

Enterprise risks include strategic, financial, operational, compliance and reputational risks. Climate-related exposures now sit across all of these: flooding disrupts operations, carbon policy changes costs, and weak disclosure creates compliance and reputational exposure.

What are some examples of climate risks?

Physical examples include floods, wildfires, storms, heat and water stress. Transition examples include carbon pricing, new disclosure rules, shifting customer demand and litigation over environmental claims.

What are the two main types of climate risks?

The two main types are physical risk and transition risk. Physical risk comes from acute events and chronic changes in climate, while transition risk comes from the policy, technology, market and legal shifts involved in moving to a lower-carbon economy. They can interact, as in the double hit scenario.

What is CCA and DRR?

CCA stands for climate change adaptation, and DRR stands for disaster risk reduction. Both aim to reduce vulnerability and exposure, and ISO 14090 and ISO 14091 give structured guidance for integrating adaptation into governance and risk assessment.

How should we start integrating climate risk into ERM?

Begin with a scoped pilot: one business unit, one region and two or three scenarios. Assign named owners, produce results in your existing risk format and report findings to the board, then expand scope in later cycles.

Sources