Climate Risk: How to Integrate It into Corporate Management Systems

Abstract

Climate risk does not require a new management system, but rather a new ability to integrate existing ones. Business Continuity, Enterprise Risk Management, ESG, Health & Safety, Property Loss Control, Facility Management, and Supply Chain already address different aspects of the same phenomenon, often without any real coordination. How can we build a truly integrated governance framework? What international standards can guide this process? And what are the first concrete steps every organization should take? In this in-depth analysis, we propose a practical approach to transforming climate risk into a structural element of corporate resilience, creating synergies among functions that, until now, have often operated separately.

—-

When a new governance issue arises, the most common reaction of organizations is to create a new process, a new committee, a new risk register, or a new dedicated function.

Given the climate risk, this would probably be the least effective choice.

Climate change, in fact, is not a risk in and of itself, but a factor capable of altering the probability, frequency, and impact of numerous risks already present within the organization. For this reason, it should be addressed as a cross-cutting issue, integrated into existing management systems, rather than as yet another organizational “silo.”

A risk that already exists… but is spread out

In most organizations, climate risk is already present, although often in a fragmented way.

The ESG and Sustainability function assesses environmental impacts, decarbonization goals, and reporting requirements.

The Health & Safety department addresses the effects of heat waves on staff, operational restrictions during extreme weather events, and the measures needed to ensure safe working conditions.

Property Loss Control and Facility Management analyze the vulnerability of buildings and facilities to floods, hailstorms, wildfires, extreme winds, high temperatures, and the availability of utility networks.

Risk Management assesses the economic, insurance, and financial impacts of events.

Business Continuity Management, on the other hand, focuses on the operational consequences: unavailability of facilities, supply chain disruptions, staff absences, loss of essential services, power outages, supplier unavailability, and recovery times.

As a result, the same phenomenon is often addressed by different departments using different languages, tools, and priorities.

The real challenge, therefore, is not deciding who should manage climate risk, but how to coordinate all these areas of expertise within a single resilience framework.

International standards are moving in the same direction

International regulations and standards are also moving toward an integrated approach.

The CSRD and the European Sustainability Reporting Standards (ESRS) require companies to assess risks and opportunities related to climate change as part of their sustainability reporting.

The European Taxonomy introduces the need to assess physical climate risks and adaptation measures for numerous economic activities.

The ISO 14090 and ISO 14091 standards provide specific guidelines for climate adaptation and for assessing vulnerability to climate change.

Furthermore, starting in 2024, the amendments introduced by ISO to the major management systems—including ISO 22301 —require organizations to assess whether climate change is a significant factor in their operating context.

It’s not about creating new systems.

The goal is to determine whether climate change alters the assumptions on which the risk assessment, business impact analysis, business continuity plans, and resilience strategies were based.

Where to start?

Many organizations can start with relatively simple but extremely effective measures.

For example:

update the risk assessment by taking into account future climate scenarios, rather than relying solely on historical data;
verify whether the Business Impact Analysis takes into account the impact of climate events on people, facilities, equipment, and suppliers;
bring together Risk Management, Business Continuity, ESG, Health & Safety, Facility Management, Operations, and Procurement at a single working table;
review emergency plans in light of heat waves, floods, hailstorms, wildfires, and prolonged disruptions to essential services;
Reassess preventive investments (protective coverings, drainage systems, fire suppression systems, water reserves, electrical redundancies, cooling systems) using updated climate scenarios.

A Single Resilience

Climate risk demonstrates, more than any other issue, just how outdated the distinction between disciplines considered in isolation has become.

Organizational resilience, in fact, stems from the integration of diverse skills.

Business Continuity, Enterprise Risk Management, ESG, Property Loss Control, Health & Safety, Supply Chain Management, Facility Management, and Insurance Management are not alternative approaches, but complementary perspectives through which to view the same phenomenon.

The most resilient organizations will not be the ones that produce the greatest number of procedures dedicated to climate risk.

These will be the companies capable of integrating climate change into their day-to-day decisions, investment processes, plant design, supplier selection, asset protection, and business continuity planning.

For the Resilience Manager, this is likely to be the most significant challenge in the coming years: transforming what appears to be an environmental issue into a fundamental component of corporate governance, thereby helping to build an organization that is truly prepared to navigate an operating environment that is bound to undergo profound changes.