How to Integrate Climate Risk into ERM: 6 Steps

I treat climate risk as a financial risk—not a separate reporting task—to build climate resilience. To bring it into enterprise risk management (ERM), I connect flood, heat, energy, and policy exposures to the decisions you already make about budgets, insurance, cash, and investments.

I use six steps to turn that work into funded action:

1. Define the scope: Name the assets, suppliers, time frames, and financial decisions to review.

2. Assess exposure and cost: Test scenarios and estimate effects on revenue, expenses, and cash flow.

3. Assign owners: Name who manages each risk and who approves spending.

4. Set limits and triggers: Decide when a warning calls for analysis and when a breach requires action.

5. Choose and fund responses: Compare avoiding, reducing, transferring, or accepting each risk.

6. Monitor and update: Check results and revise forecasts, budgets, and capital plans.

For example, I can test energy-cost increases of 10%, 20%, and 30% to see where margins or cash become strained. These are stress tests, not predictions. My goal is simple: <u>each material risk has an owner, a financial estimate, an action trigger, and a funding decision.</u>

How to Integrate Climate Risk into ERM: 6 Steps

ESG Risks - Module 6: Climate Risk Integration -6.5- Integrating Climate into ERM & TCFD Frameworks

sbb-itb-8baf5f1

Step 1: Define the Scope and Financial Decisions

Create a one-page scope charter that names the decision, decision date, intended financial output, and materiality threshold.

Specify the legal entities, regions, sites, value-chain nodes, and financing arrangements covered. Document every exclusion and explain why it was left out. Then map physical and transition risks to those boundaries and the financial decisions they inform. A review limited to sites can miss supplier, logistics, and demand risks.

Apply the same short-, medium-, and long-term horizons across financial models, board materials, and the risk register. Extend the analysis when an asset’s life exceeds the forecast window. IFRS S2 requires organizations to explain these horizons and how they connect to business strategy decisions.^[6][7]

With those boundaries set, identify the assumptions finance needs to test.

Identify Financial Assumptions at Risk

Have finance build an assumption register for each decision. For every assumption, record its baseline, source, owner, update date, affected model, and climate-tested range.

Cover maintenance expense, energy and fuel prices, labor productivity, disruption days, inventory buffers, insurance premiums and deductibles, repair costs, useful lives, residual values, demand, pricing, borrowing costs, capital needs, and working capital.

The table below links exposure boundaries to planning variables and decision owners.

Use the register to guide exposure testing and financial impact estimates.

Set risk-register entry criteria using existing ERM materiality standards - not hazard severity alone. Include exposures that could materially affect revenue, cash flow, asset value, liquidity, compliance, safety, or strategy.

Add a risk when its exposure crosses the approved threshold, affects multiple business units, threatens a critical service, or depends on an uncertain external factor that needs monitoring. Describe it in business terms:

“a 10-day flood interruption at Facility A could reduce annual revenue and require unplanned capital spending”

Keep lower-priority exposures in a monitored inventory, with clear conditions for escalation. These criteria determine which risks move into scenario testing.

Step 2: Assess Exposure and Financial Impact

Use your existing ERM scoring method to rank climate exposures by operating dependency, financial effect, and data confidence. Map exposures across owned and leased assets, operations, suppliers, logistics routes, and customer markets. Connect each exposure to the activity it could disrupt and the financial effect that could follow.

Rate likelihood, severity, speed, duration, and interdependencies. When probabilities are unreliable, use ranges or document a plausible risk without assigning a number, explaining why. Keep risks with missing data in the register; lower the confidence rating rather than remove them. Work with operating teams to verify coordinates, values, dependencies, insurance terms, and disruption history. Record sources, dates, and proxies. Then test the exposure map’s financial impact under climate scenarios.

Test Scenarios and Estimate Financial Effects

Test orderly, disorderly, and higher-warming scenarios. Use NGFS scenarios for climate and macroeconomic inputs.^[8][9] Combine those inputs with location, business activity, emissions, supplier, and financial data. Match analysis periods to the budget cycle and asset life. Label outputs as scenario estimates - not forecasts, and document assumptions, management actions, and uncertainty.

Trace each result from climate driver to operating change to financial effect. Estimate effects on revenue, operating expenses, capital spending, asset values, working capital, liquidity, insurance, financing costs, and downtime. Test energy-cost increases of 10%, 20%, and 30%.

Use one baseline and separate gross loss from residual impact. Scenario losses do not automatically become impairments or provisions. Reconcile lost sales, lost contribution margin, repairs, insurance recoveries, and borrowing needs so the same effect is not counted twice.

Use the ranked results to update budgets, forecasts, and capital priorities.

Prioritize Risks for Budgets and Forecasts

Add climate drivers to the risk register. Rank findings by financial materiality, concentration, urgency, control strength, and data confidence - not dollar size alone. Record the affected planning cycle and the trigger for reassessment. Translate findings into revised cost assumptions, inventory funding, liquidity needs, or capital requirements.

Use the table to prioritize budget and forecast updates. Estimates are illustrative, in U.S. dollars, and are not company results.

The highest-priority items move into ownership and approval in Step 3, including budget responsibility.

Step 3: Assign Owners and Approval Authority

Use the Step 2 ranking to assign ownership and approval authority. Give each material climate risk one named business owner. Follow the Three Lines Model: management owns risks and controls; risk and compliance challenge them; internal audit tests governance and control effectiveness. Internal audit should not approve or operate controls it will later test.^[11][12]

The board or designated committee oversees risk appetite, material exposures, and major resilience spending. Name an executive sponsor to resolve cross-functional issues and route funding decisions to the right authority. Board reports should focus on decisions needed, overdue actions, and exposures approaching tolerance limits.^[13]

Finance should own or approve climate-sensitive assumptions used in budgets, forecasts, valuations, and capital requests. Business leaders own the underlying data and controls, while sustainability teams supply climate data and methods.

Document Responsibilities and Spending Authority

For each material risk, document the risk owner, control owner, planning owner, mitigation deadline, escalation trigger, reporting cadence, and required evidence. Also name the budget owner, executive sponsor, and person responsible for resolving disagreements, and record any dependencies. Require dated evidence, such as maintenance records, purchase orders, control-test results, and approved model updates.

Set delegation-of-authority limits that state who can approve resilience spending, capital requests, contingency funds, insurance changes, forecast revisions, and residual-risk acceptance. Review these limits annually. If a breach occurs between reviews, the risk owner must notify finance and the executive sponsor, quantify the effect, propose interim controls, and escalate material breaches to the board committee. These authorities define the limits and triggers used in Step 4.

Step 4: Set Limits, Metrics, and Action Triggers

Use the highest-priority risks from Step 2 and the named owners from Step 3 to set each limit.

Match limits to loss capacity, not just risk appetite. Test each limit against cash, earnings volatility, covenants, insurance, and contingency funding. For each material exposure, define a normal range, an early-warning threshold, and a breach limit. Link all three to budgets, forecasts, and capital allocation.

Cover high-hazard sites, outages, revenue loss, recovery time, uninsured losses, supplier concentration, and transition-sensitive costs. Connect emissions-heavy assets to financial metrics: emissions alone do not quantify financial risk.^[14][17] Early warnings trigger analysis; breaches trigger a decision. Test limits across physical-risk and transition scenarios, using ranges when estimates are uncertain.^[17]

Link Thresholds to Financial Actions

Pair leading indicators - backup-power readiness, adaptation-project completion, and projected carbon costs - with lagging results, such as outage hours, repair costs, energy-cost variance, water use, and actual emissions. Record each metric’s baseline, unit, formula, data source, owner, and reporting frequency. State whether targets are absolute or intensity-based, and separate measured data from estimates.

Use the table as a template, adjusting each threshold to loss capacity and approval authority. Every trigger should lead to a specific financial action - not just a report to management. Assign the Step 3 risk and budget owners to each row, and route breaches to the named approver.

Metric or limit	Threshold	Financial effect	Responsible owner	Review cadence	Escalation action
Critical-site outage	More than 72 hours per event	Revenue interruption and emergency operating costs added to forecast	Named business risk owner; budget owner	Monthly and after each event	Release contingency funding; approve backup-power capital
High-hazard facility exposure	More than 15% of replacement value in severe flood or wildfire zones	Higher expected loss and insurance premium pressure	Named business risk owner; control owner	Quarterly	Require mitigation plan, relocation analysis, or revised insurance
Supplier concentration	More than 30% of critical input volume from one high-hazard region	Production shortfall and expedited-shipping costs	Named business risk owner; budget owner	Monthly	Qualify alternate suppliers and revise supplier terms
Transition-sensitive operating cost	More than 8% increase in energy or carbon-related costs	Lower margin and revised earnings forecast	Named planning owner; finance	Quarterly	Reprice products, fund efficiency projects, or revise capital priorities
Emissions-intensive asset	Project fails minimum return under a defined transition scenario	Impairment, stranded-asset, or investment-loss risk	Named business risk owner; budget owner	At approval and annually	Redesign, defer, or stop investment
Insurance protection gap	Modeled loss exceeds available coverage by more than $2 million	Unfunded loss and liquidity pressure	Named business risk owner; budget owner	Before renewal and after material exposure change	Increase coverage, retain risk explicitly, or fund mitigation

Set a deadline for escalation. Each trigger should name the decision deadline, required financial analysis, and possible funding source. Include financing sensitivity, such as debt-service coverage under higher energy costs. Apply approved triggers to rolling forecasts, liquidity plans, and capital priorities.

These triggers feed the response choices in Step 5.

Step 5: Choose Responses and Fund Action Plans

When a trigger is hit, choose a treatment and fund it. Decide whether to avoid, reduce, transfer, or accept the risk based on severity, timing, controllability, regulation, and cost.

Before relying on insurance, contracts, or hedging, check policy wording, limits, waiting periods, exclusions, counterparty credit strength, and renewal assumptions.

Compare Responses and Approve Funding

Compare options using the same budget and capital-request assumptions. Cover risk reduction, upfront capital cost, recurring operating cost, implementation time, useful life, residual exposure, liquidity needs, and tax or accounting treatment. Also assess effects on revenue, margins, debt capacity, and cash flow.

Use the table to narrow the options, then document the chosen treatment before approving funding.

Require a one-page treatment record that covers:

• Risk statement, cause, affected asset or process, time horizon, baseline likelihood, financial impact, and transmission channels.

• Treatment type, expected reduction in likelihood and impact, and confidence level.

• Capital expenditure versus operating expense classification; upfront amount in U.S. dollars; recurring annual cost; payment schedule; and funding source - operating budget, capital plan, insurance premium, contingency reserve, or external financing.

• Accountable owner, implementation milestones, and approval authority.

• Expected return, avoided loss, resilience value, or business benefit.

• Residual exposure, trigger metrics, and review date.

• Dependencies, including permits, suppliers, contracts, and maintenance needs.

Finance tests cash flow, NPV, payback, and accounting. Risk tests residual exposure and scenario coverage. Operations confirms feasibility and maintenance needs, while legal and insurance check transfer terms. The business owner remains responsible for delivery. This cross-functional review helps reduce model bias and speed approval.

If no further treatment receives funding, document why acceptance is justified and who approved it. Include the estimated residual likelihood and impact, maximum credible loss, insurance limitations, contractual constraints, affected financial assumptions, and conditions that would reopen the decision. Set a review date, such as the next annual ERM cycle or an earlier trigger-based date. Acceptance still requires monitoring, contingency planning, and an escalation trigger.

After choosing risk-reduction treatments, assess value-creation projects on their own merits. Evaluate resilient infrastructure, lower-carbon products, and efficiency separately so commercial upside is neither mixed with risk reduction nor counted twice.

Test Investments Across Climate Scenarios

Test each investment under at least three scenarios: a baseline or current-policy case, a faster-transition case, and a more severe physical-risk case.^[10][4] For each, estimate when and how much revenue, operating expenses, maintenance, capital spending, insurance premiums, working capital, asset life, and downtime could change. Calculate cash flow, net present value, and payback using consistent discount rates and clearly disclosed assumptions.

Run sensitivity tests for uncertain variables, including hazard frequency, carbon prices, energy prices, repair costs, demand, and discount rates. Fund projects that perform well across scenarios now, phase uncertain investments, or retain flexibility when results depend heavily on assumptions.

Model avoided loss as a range, then compare it with annual maintenance cost, financing cost, and useful life.

Add approved spending and payment dates to budgets, long-range plans, and capital allocation. Update insurance decisions and investment appraisals to account for the remaining risk.^[16]

Once funding is approved, put the action into budgets and track results against the trigger metrics in Step 6.

Step 6: Monitor Results and Update Financial Plans

Use the approved limits, owners, and treatment plans from Steps 3–5 as your review baseline. Check each relevant risk entry, control, threshold breach, incident, near miss, treatment, and budget variance. Compare results with approved limits, assumptions, scenarios, and mitigation targets to guide updates to budgets, forecasts, and capital plans. Track downtime, uninsured losses, supplier interruptions, and cost variance to see whether controls reduce disruption and losses.^[5][15]

Validate the data before changing assumptions. Reconcile facility, asset, supplier, and insurance records with finance and operations data so ERM and financial planning work from consistent inputs. Flag missing data, outdated estimates, and mismatched units. Record scenario versions so teams can distinguish changes in exposure from changes in the model. Finance should revise the forecast only after the data is reconciled.

Schedule Reviews and Funding Updates

Use these reviews to adjust budgets, capital timing, and insurance decisions. Review high-impact or fast-changing risks monthly or quarterly, and stable risks semiannually or annually. Reassess affected risks after major weather events, regulatory changes, acquisitions, supplier changes, or new scientific findings. Update both physical-risk and transition-risk assumptions when these changes could materially affect financial results.^[5]

When a threshold is breached, the risk owner should validate the breach, apply temporary controls, and escalate within the agreed deadline. Finance should then revise affected revenue forecasts, operating budgets, capital-project timing, working-capital needs, contingency funding, and insurance assumptions. Keep planning allowances separate from accounting reserves. Reserves must meet recognition and measurement rules; scenario losses alone are not enough.^[5][6]

Share operating findings with risk owners, and forecast and funding changes with finance leaders. Inform executives about material breaches and spending decisions. On the board’s agreed reporting cycle, report material residual exposure, risk-appetite exceptions, and effects on capital allocation. Retain decisions, approvals, forecast revisions, and the reasons for acting - or not acting.^[5]

Conclusion: Make Climate Risk Part of Routine ERM

Turn the six steps into a repeatable cycle that links climate risk decisions to financial plans. Climate risk belongs alongside budgeting, forecasting, and capital allocation - not in a separate sustainability exercise.

Every material climate risk needs an owner, financial estimate, threshold, response, funding source, and review date.

Before the next budget cycle, check that:

• Each material climate risk has one owner.

• Thresholds, funding, and decision authority are approved.

• Scenario results are reflected in budgets and capital plans.

• Monitoring metrics and review dates are current.

FAQs

How can we start with limited climate data?

Don’t wait for perfect data. Start with a qualitative risk screen: map climate drivers to business units or assets, then identify possible financial effects, such as higher costs or lost revenue. Rank those exposures to decide which need deeper analysis.

Next, run directional stress tests to see which assumptions make a meaningful difference to financial outcomes. Feed the findings into existing capital budgeting and business planning cycles.

How do we prioritize climate risks on a tight budget?

Start with a staged risk screen: identify physical, transition, and opportunity risks, then rank them by expected financial exposure - lost revenue, higher costs, asset impairment, and capital spending needs. Focus existing planning on the most material exposures across facilities, suppliers, and revenue streams rather than trying to address every risk.

Quantify only the top risks, using order-of-magnitude ranges across a few scenarios. Feed those results into enterprise risk management (ERM), capital budgeting, and budget and forecast stress tests. ^[1][2][3]

How can we measure the ROI of climate resilience?

Measure return on investment (ROI) by linking climate resilience efforts to financial planning. Track operating cost savings, lower risk exposure, and better access to capital.

Key metrics include revenue at risk, adaptation capital expenditures (CapEx), potential asset impairment, investment payback periods, avoided emissions, and production downtime saved. Add these metrics to annual budgets and performance reviews so teams can see and measure how resilience efforts cut costs and reduce risk.