People, Planet & Performance: sustainability guide for risk and insurance managers

PEOPLE, PLANET
& PERFORMANCE
FERMA FOCUS
SUSTAINABILITY
The Contribution of Enterprise
Risk Management to Sustainability
40+
YEARS
As the single
recognised voice
of European
risk managers
21
COUNTRIES
5000
RISK MANAGERS
IN EUROPE
22
MEMBER
ASSOCIATIONS
www.ferma.eu

02
About FERMA
The Federation of European Risk Management Associations
brings together 22 national risk management associations in 21
European countries. FERMA represents the interests of nearly
5000 risk and insurance managers in Europe active in a wide
range of business sectors from major industrial and commercial
companies to financial institutions and local government bodies.
More information can be found at www.ferma.eu

03
FERMA presents this guide on sustainability in the midst of the
global COVID-19 pandemic. Less than a third of risk managers
had a global pandemic as part of their risk register in September
of 2019. Yet, in 2020, that risk became reality. The financial and
societal impacts have been far-reaching already and will be felt
for years to come.
Among the many consequences of this pandemic, FERMA has
observed a renewed focus on 1) the risk environment; and 2)
how to make businesses more resilient. We, risk managers, are
being looked to – perhaps more than ever – for our insights on
what will come next and how to better manage the associated
risks, with a view to making our companies more resilient.
Risk managers provide their organisations with an enterprise-
wide view of both the potential impacts and the opportunities
related to the various risks that can materialise. One of the
tools of the risk manager, Enterprise Risk Management (ERM),
facilitates this process. ERM provides a robust framework to
identify, assess and mitigate risks. Inherent in the risk manager’s
role is also the ability to prioritise risks that should be at the
forefront for the Board.
More is happening on sustainability every day. This is set
against a policy background of the European Green Deal, in
which the EU makes a legal commitment to climate-neutrality
by 2050. There are other initiatives in many parts of the world.
Part of our role as risk managers is to translate these initiatives
into their implications for our organisations. Some risk
managers have been doing this for years, but organisations
vary in their maturity on the topic.
Our European Risk Manager Report 2020 revealed that 60%
of risk managers were not yet involved in ESG-related risks
in their organisation. To help fill this gap, as well as to take
stock of where we are now, FERMA’s Sustainability Committee
has created this guide with two goals: 1) as a practical guide
for risk managers who wish to embed more sustainability
considerations into their processes and into their organisations.
2) as examples of good practices from work that risk managers
have already carried out on sustainability.
Our guide can, therefore, be both a starting point and material
for reflection for risk managers. It cannot provide guidelines
on every aspect of the increasingly vast range of topics that
broadly belong to the term sustainability.
Finally, a warm thank you and congratulations to the FERMA
Sustainability Committee for its hard work in producing this
guide. We also thank the risk managers who generously
contributed their knowledge and experience.
FOREWORD
Valentina Paduano, Chairwoman of the Sustainability Committee
"In our view sustainability should now be front and centre of everyone's mind."

04
INTRODUCTION
Existing guidance and best practices
• World Business Council for Sustainable Development
(wbcsd) and COSO, Applying Enterprise Risk Management to
Environmental, Social and Governance-related Risks
• Task Force on Climate-Related Financial Disclosures (TCFD),
Implementing the Recommendations of the TCFD
• ISO 31000 ‘Risk Management' and ISO 26000 ‘Social
Responsibility’
Aim and approach
This document aims to provide corporate risk and insurance
managers with guidance on dealing with the increasingly
significant topic of sustainability. Corporate Social Responsibility
(CSR) and Environmental, Social and Governance (ESG) issues
are not new. They are increasingly blending into the inclusive
term sustainability. We, therefore, believe it is an important
moment to assemble current thinking on these topics and what
they mean for risk management.
Over the winter 2020/2021, FERMA polled its members on
what they would find useful in a guide on sustainability. The
risk managers who responded have generally been involved in
some way with their organisation’s approach to sustainability.
Therefore, the feedback received can be considered as
reflections on the ‘sustainability journey’ to date.
Then, to help us further develop the guide we organised
exchanges of good practice among members of the FERMA
Sustainability Committee. To complement this, we also sought
views from other experienced risk managers through nine
semi-structured interviews.
It is important to stress that this guide is not meant to replace
existing guidelines or processes. It is intended as a reference
point for further consideration and exploration.
Context for the risk manager
Companies have been communicating on non-financial matters
such as CSR for decades, widening into ESG matters more
recently. An enterprise-wide approach to sustainability that
incorporates opportunities and risks over the long term is one
of the latest parts of this evolution.
According to the input received, many risk managers have
been involved in their companies’ reporting on sustainability,
for example the preparation of their non-financial reporting
disclosures, annual reports, or reports on sustainability. But
evidently, a risk manager’s primary role is to warn and anticipate
rather than to report.
Organisations are at different stages of maturity in their
sustainability approach and have different ways of identifying,
analysing,assessinganddealingwiththerisksandopportunities.
Our focus in this report is how the risk management function
fits within this picture.
FERMA makes the following observations on the state of play
between risk management and sustainability.
• A corporate culture that embraces enterprise-wide risk
management is a fundamental factor in determining how
organisations approach and deal with sustainability.
• Managing sustainability requires mature risk management
as a long-term project to build resilience and take
advantage of opportunities from the green transition.

05
• Risk management can help identify and communicate
sustainability issues that are specific to the company.
• Risk management is in a strong position to support
specialist functions’ knowledge of activities and operations
across the enterprise and methods of treating risk.
• Risk management can facilitate cross-function
communication.
• The ERM framework may offer a consolidated model of
good governance and practices that can eventually allow
the integration of sustainability into risk management.
A brief policy context
The increase in speed in pursuit of sustainability goals through
policy post-financial crisis can be, broadly speaking, traced back
to the UN Sustainable Development Goals. Ultimately, the aim
of these goals is to promote prosperity while protecting the
planet, achieving a better and more sustainable future.
On this front, the EU is particularly ambitious. In 2020, the EU
announced its strategy for climate neutrality by 2050 as part
of the European Green Deal, which is a key pillar of European
Commission President Ursula von der Leyen’s strategy for her
time in office.
The European Green Deal is a response to climate and
environmental challenges. It is intended, in the words of the
Commission, as a new growth strategy to transform the EU into
a fair and prosperous society, with a modern, resource-efficient
and competitive economy. It expects businesses to behave not
just as good corporate citizens, but also to use their operations
and assets to strengthen the resilience of the community.
Significantly, the Green Deal has for the first time set out a legal
commitment for the EU to target climate-neutrality by 2050,
with the European Climate Law. This act will also ensure that all
EU policies contribute to this overall goal, and that all sectors of
the economy and society play their part.
To support the green transition, the EU aims to channel more
investment into greener activities. This aim has been formalised
in the European Commission’s Strategy for Sustainable Finance.
In this strategy, the Commission identified the financial sector
as a key enabler to support economic growth, while reducing
pressures on the environment and taking into account social
and governance aspects. There will be a renewed strategy on
sustainable finance before the Summer of 2021. It is expected

06
to pick up the theme of reorienting capital towards more
sustainable activities.
An important enabler of ‘greener’ investments is data. In a bid to
improve both supply and quality of data on the sustainability of
economic activities, the Commission has encouraged increased
disclosure of climate and environmental data so that investors
– and stakeholders – are better informed. More specifically,
organisations are increasingly required to disclose information
on how and to what extent their activities are associated with
environmentally sustainable economic activities.
Vital in this regard is the Non-Financial Reporting Directive
(NFRD), which is an instrument aimed at enhancing the
transparency of social and environmental information provided
by undertakings (of a certain size) in all sectors. The NFRD is
currently under review and an updated proposal is expected
for Q2 2021.
Further, the ambition to ensure transparency on risks related
to ESG factors that may impact the financial system and the
mitigation of such risks through the appropriate governance
of financial and corporate actors is articulated through the
Commission’s work on the EU Taxonomy. This taxonomy is an
effort to provide a common classification system for sustainable
economic activities (by ESG).
It is also anticipated that the Commission will propose an
initiative on sustainable corporate governance in the first half
of 2021. Stemming from this initiative we could see mandatory
supply chain due diligence and a duty of care for directors. This
work has taken inspiration from legislation at national level,
e.g. Article 169 of the French law on Business Growth and
Transformation (the PACTE law), as well as that at supranational
level, such as the OECD’s work on due diligence guidance for
responsible business conduct.
More recently, the political agreement reached by the European
Parliament and the Council on the EU economic recovery
package requires Member States to devote at least 37% of their
expenditure to investments and reforms that support climate
objectives. The so-called Recovery and Resilience Facility will
also require Member States to support the green transition by
obliging them to apply the ‘do no significant harm’ principle on
all measures.
The above is a selection of the various strands of public
policy aimed at reorienting the economic system away from
short-term maximisation of shareholder value and towards a
longer-term, more sustainable vision. They provide a short and
targeted context for this guide.

07
For the sake of clarity in this publication, we outline here what
we mean by some key terms, since sustainability and ESG
tend to be used inter-changeably. Ideally, the definition will be
principles-based and not try to cover every eventuality.
Sustainability: encouraging businesses to frame decisions in
terms of financial, environmental (including climate, biodiversity),
social and human effects ensuring resilience and long-term value
creation. – FERMA Sustainability Committee1
Sustainability risk: Uncertain social or environmental event
or condition that, if it occurs, can cause significant negative
impact on the company. It also includes the opportunity that
may be available to an organisation because of changing social
or environmental factors (wbcsd and COSO).
ESG-related risks: Environmental, social and governance risks
and/or opportunities that may impact an entity are commonly
referred to as sustainability, non-financial or extra-financial
risks. (wbcsd and COSO) .
As a broad term, sustainability has different implications for
different companies. The risks associated with it will relate to
the ESG practices of the business, its strategy and the sector
and territories in which it operates. By saying that, we consider
that ‘ESG’ belongs to sustainability—i.e., that sustainability is
the broader concept. To illustrate what we consider as ESG,
we provide the following classification agreed by the FERMA
Sustainability Committee:
1 Inspired by the European Commission’s definition of sustainability in the consultation on Sustainable Corporate Governance: Sustainability encompasses
encouraging businesses to frame decisions in terms of environmental (including climate, biodiversity), social, and human impact for the long-term, rather
than on short-term gains
2 Diagram adapted from MSCI what is ESG? https://www.msci.com/what-is-esg
DEFINITIONS
Environmental Social Governance
Climate
Resources
Pollution/waste
People and communities
Products and services
Internal and external
stakeholders
Corporate governance
Business ethics
and behaviour
FERMA classification of ESG2
:
WHAT DO WE MEAN BY SUSTAINABILITY AND SUSTAINABILITY RISKS?

08
For me, it is actually the
umbrella for most things
you do as a business…it is
not limited to environment.
– Risk manager, Sweden
It’s part of responsibility in our company. It is better to
understand that it is part of being a responsible person in
a responsible company. This includes the compliance-based
requirements and then it goes into ‘how’ you operate.
– Risk manager, Finland
Perhaps sustainability has always existed in companies as
financial sustainability in order to avoid bankruptcy? Nowadays
the meaning is around ESG, but the aim remains to survive, thus
adapt and transform the company to a rapidly changing context.
Whateverthedomainis,theroleofERMistoanticipateandavoid
negative impacts, and set up a risk culture that is key to enable
all stakeholders’ contribution to the aim of collective goals.
– Risk manager, France
As a risk manager, sustainability is really an important issue.
The first point I want to mention is that when you are a risk
manager, you need to mitigate risk, and you need to make
your best effort to avoid a claim and business interruption…
the second point is that today there is a green wave, which is
coming in our companies.
And, we want our businesses to be low-carbon impact, so
we want to reduce the impact of our activities. Here the risk
manager can help the company to find and evaluate the risk
associated with that.
Sustainability is a target to be considered. These are strategic
targets, like business targets. I consider it as something that
could be impacted by a risk. So we have to manage ESG like
other topics that are important to the continuity of business.
– Risk manager, Italy
Sustainability is everything that allows us to create value, not
just taking into consideration actual needs, but also taking into
our needs into the future. It is not just economic and financial,
but we also take into account additional aspects, such as
environmental, social, and all the possible ways of improving
wellbeing.
We have three elements when we talk about it. There is the
financial sustainability element of it, of course. It is a huge part.
Then there is the environmental one, which we have captured
for many years in that we always ask in risk management for
the non-financial impact and risks. We ask everyone in the
company, independent from the financial threshold for this
calculation. Then it is also in the social part and there we talk
about health and safety, human rights, supply chain topics.
- Risk manager, Sweden
Risk managers on sustainability

09
SUSTAINABILITY RISK MANAGEMENT PROCESS
Sustainability risk management is a business process supporting the company’s sustainability goals.
It aims at aligning sustainability with risk management by using the principles of enterprise-wide risk management.
– FERMA Sustainability Committee
There is no one size fits all solution for sustainability risk
management. But based on our exchange of views, there are
some key themes that emerge, which we will explore in this
section.
We propose a template to consider these issues based on the
common risk management process:
• Preliminary settings
• Risk identification and prioritisation
• Risk assessment and treatment
• Risk reporting, communication and disclosure
Those that are well underway in their ‘sustainability journey’
take an enterprise-wide approach to ESG risks and link them
to overall strategic objectives. This is done by focussing on
material ESG issues that could threaten the strategic goals of
the organisation (as well as offer opportunities).
At the other end of the scale, some organisations may be
starting to consider how to integrate sustainability risks into
their overall approach, or may consider starting with a different
approach to sustainability before integrating it at a later date.
“Do not re-invent the wheel! Sustainability risk management
should use the same methodology as for other risks.”

10
Illustration of the sustainability risk management process
Risk reporting,
communication
& disclosure
Internally for decision making
Externally to meet regulatory
requirement and inform
stakeholders
Risk assessment
and treatment
High priority risk focus
Stakeholder input,
internal and external
Risk responses
Preliminary settings
and context
Internal factors
External factors
Time horizon
Risk identiﬁcation
and prioritisation
Risk register/catalogue
Commitees
Data
Strategic goals
& risk appetite

11
It is better to have a light
procedure to sustainability
risk management since you
cannot be prepared for
everything, as the COVID-19
pandemic crisis has shown.
It is better to be pragmatic.
In our organisation, the risk management and sustainability
departments were merged some months ago, under the
same director (myself). We are now studying a way to create
continuous synergies between the two activities with the aim of
developing a Sustainability ERM in the next months.
For me it means that the tasks and the understanding of
enterprise risk management and risk management in a
company should change. At least what I observe is that many
are still struggling to find that right way. There are many old
ways of thinking that are an obstacle. For example, a core
financial risk manager might say something like risk is deviation
from business plan. But this doesn’t capture the problem we
are talking about. It does not deal with the fact that there could
be child labour in the supply chain, or the climate change impact
on our company…The sustainability topic is really key not just
talking about it but really implementing it and changing ways
of working where it is really necessary, and risk management
is one of those, I think.
For ERM practitioners, the process is similar to all other risks.
Specificities come with 1/ the long-term effects of most ESG
risks (though we may wonder whether it is still long-term!) and
2/ the laws on reporting and information for companies ESG
risks. From my perspective it is absolutely the case that ESG/
sustainability has led risk management (and risk managers) to
work in depth and even more with functions such as corporate
social responsibility / human resources / health and safety /
security / business continuity and crisis management / etc.
As our CEO says, we do not
have a sustainability strategy.
Our strategy is sustainable.
For us sustainability is fully
integrated into our processes.
We do not have a dedicated
category of risks defined as
sustainability.
We have to go beyond traditional risk management. For me
traditional risk management is that we as a company are
doing these activities, and if we are going to do that what are
the risks going to be? But now, we have to switch from these
post-strategy risks to a pre-strategy mindset. And that is really
looking at what is happening in the world, now and in the future
and how that can be translated to us as a company. For each
company that’s going to be different.
– Risk manager, Belgium
The identification and assessment of sustainability risk are
an integrated part of our company’s process for identifying,
quantifying and managing risk. Hence ESG concerns are in
focus at all levels and functions of the organisation. ERM is
also part of the team putting together the annual sustainability
report.
Risk managers on integrating sustainability into
risk management

12
Preliminary settings
Context
A foundation for any of the next steps is first establishing the context in which you operate. A good way of looking at this is to consider
both internal and external factors confronting your organisation.
Most of the risk managers we have spoken to have emphasised
the enterprise-wide perspective they can take as being a
foundational part of their sustainability approach. It is good to
analyse and map out the key elements to your own organisation
before looking outside of it. Risk should be aligned with the
other sustainability related functions.
In several instances, we have spoken with risk managers who
are also the head of their sustainability function. Wearing
these two hats may be a good strategy. However, it also can
come with pitfalls. Potentially the advantage of having a risk
manager ‘independent’ from sustainability is that they can offer
a different perspective.
We have also heard risk managers regularly mention the
importance of ‘culture’, which is difficult to define but also – and
crucially – hard to change. This is why it is important to establish
the context and analyse the key people in your organisation to
effect change in the realm of sustainability.
For external matters, the effect of changes in public opinion
and policy, with EU and international goals for carbon
neutrality, sustainable investments and social responsibility,
are less specific. The effect on the business may be gradual or
could happen all of a sudden (as in the case of the COVID-19
pandemic). These unforeseen events could be more serious in
the long term.
Internal factors to consider
Map your internal stakeholders
Is there a sustainability colleague or department?
Who else would be good to involve?
Who needs to be involved?
Consider your governance structure
Is there an important committee to inﬂuence/be part
of? What are your reporting lines? Who are the key
inﬂuencers or sponsors of risk and sustainability?
Consider organisational culture
Do you have to push this, bottom-up? Is the
direction coming from the top management?
External factors to consider
Map your external stakeholders
Suppliers, customers, investors, but also since
sustainability is broader this also means
considering the communities you operate in
Local, national, and international environment
Rules and regulations, cultures and norms, etc.
Your organisations industrial sector
For instance, if in energy is there a heightened
scrutiny on environmental performance?

13
The time horizon is a necessary clarification to address the management discussion on which topics to focus attention and balance
the expected impacts.
The impact of external factors – difficult to map and estimate -
could be a ‘reputational’ risk for the company to be qualitatively
evaluated by the management.
Time horizon
It is important to analyse sustainability risks by their potential
impacts on operations and strategic goals while applying a
time scale. This is standard risk management practice, but for
sustainability, the time element is likely to be more important
than for most fortuitous risks. This means a strong case for
resource allocation will need to be made.
In the diagram below, we provide a visual idea of areas for
consideration in setting the time horizon. Fundamentally, the
sustainability approach should be aligned with the overall
strategic plan of the organisation. You can try setting your
horizon on sustainability risks the same as for other risks. The
longer-term risks will likely be part of the company risk profile,
but may not currently fall into the heat-map due to not being
as immediate as other risks.
Align with organisational
strategic plan
Align with same time
horizon as other risks
Align with policy/
regulatory targets
· Often 3-5 years in range
· Where do you want to be with
sustainability in short, medium
and long term?
· Keep in mind that sustainability
implies 'longer term'
· This also allows comparison with
other risks mapped through ERM
· Such as the 2050
climate-neutrality goals
· This orients towards
longer-term thinking too

14
Risk Identification and Prioritisation
The key question to ask is how would you normally identify
risks?
• If your approach is based on keeping a risk register, then
you can consider thinking about ESG/sustainability risks in
this register or catalogue.
• If the approach is to set-up a committee of colleagues and
discuss the various perspectives, then perhaps the best
idea is to also bring in a sustainability perspective.
• Several risk managers sort their risks into buckets, such
as ‘strategic – operational – external’. If this is the case,
then adding a sustainability overlay to this existing process
could be helpful.
• Or, you may wish to think about it differently and set up a
deep analysis of all sustainability risks on your radar.
ESG category Risk area Risk events
ENVIRONMENT Climate change Changes in policy and regulatory context
Timely development of innovative and eco-responsible products and
technologies, supporting reduction of CO2 emissions and consumer preferences
Effective deployment of industrial and logistics carbon footprint, supporting
reduction of energy consumption in production processes in favour of
renewable energy, etc.
Business interruption due to chronic (e.g., temperature increase, precipitation,
etc.) or extreme events (e.g., floods, cyclones, etc.) on key company assets – i.e.
physical risk
Responsible use of
natural resources
Optimisation of material cycles in industrial processes, in terms of recycling,
re-using parts, reconditioning components and waste management
Preservation of biodiversity and land use
Sustainable water management
Table idea for ESG risk identification

15
The above list should be adapted, customised and finalised through consultation with your colleagues and management.
ESG category Risk area Risk events
SOCIAL Human resources
management
Protection of occupational health and safety
Attraction, retention and professional development of talents
Diversity, equal opportunities and well-being within the organisation
Product liabilities Product reliability, guaranteeing the compliance with quality and safety
regulations
Company impact
in communities in
which we operate
Breach of trust in local areas
Balanced governance and distribution of added value
GOVERNANCE Business ethics and
integrity (corporate
behaviour)
Prevention, detection and countering any unlawful behaviour by employees
and collaborators (incl. corruption, extortion and bribery) and compliance with
related national and international legislation
Adoption of responsible procurement practices across global value chain,
preventing ethics violations

16
Weestablishedanassuranceworkinggroupwhereallassurance
parties work together. We start from risk-based topics and
follow-up and report on those. This group meets quarterly. And,
we have a dashboard on this, where we look into prevention,
monitoring and reaction/action (including remediation action
taken those) on the sustainability topics that can affect us.
– Risk manager, Finland
The identification and assessment of sustainability risk are
an integrated part of [our company’s] process for identifying,
quantifying and managing risk. Hence ESG concerns are in focus
at all levels and functions of the organisation. ERM is also part
of the team putting together the annual sustainability report.
Environmental risk: We
have worked with other
departmentstoidentifysome
key environmental risks,
such as a water shortage.
We are now working on improving this activity of risk analysis
concerning ESG-topics. We will do this by surveying our top- and
middle- management on their view on potential risks related to
ESG in their department. By doing so we aim to improve and
expand our risk universe and to have all of these events for
consideration in our risk analysis
Social risk: The Covid-19 situation allowed risk managers to
showtheiraddedvalueintheprotectionofhumancapital,which
is key. For instance, last year I worked with the HR Department
to improve travel risk for our employees abroad. The problem
we had was to follow our travellers, to localise them and to
communicate with them. The travel tracker tool provide by
our supplier allows the HR Director and me to assess risky
situations more quickly and know who can be affected by them.
Governance risk: For governance risks, I work closely with the
CSR Department, and it is a good point, since it is not always
the case in other companies. I bring them the risk mapping
methodology, a non-specialist view and my knowledge of other
related risks. We build a strong and complementary team.
We have to encourage our
people to be sustainability-
minded and make it part of
our DNA. We have formalised
the CSR role, and we also
work with external parties
to look into various aspects
of how we operate. For
example, how much paper
we go through, how much garbage we produce, how much
electricity we use, etc. This was part of our normal being and
doing, but now we have formalised the role, so it makes sure
that there is really someone looking into these types of risks.
– Risk manager, Belgium
Risk identification and ways of looking at ESG
risks - examples from risk managers

17
The above sample of ESG risks will also support the development of a common language on ESG risks within the organisation. It
should allow the risk manager to see whether there are gaps in the existing risk catalogue.
This analysis should leave the risk manager with a picture of how ESG risks are currently managed and treated within the organisation.
Once discussed with the top management, the identified risks can be tracked in the overall risk register (or catalogue, however it’s
defined within your organisation), together with other business risks. A specific classification as ‘ESG-related risks’ could be highlighted
as below.
Sample of risk register/catalogue integrated with ESG-related risks:
Since the aim of the ERM model is to focus on the main critical risks could negatively affect the achievement of strategic targets, the
results of the risk Identification phase will be a list of high priority risks on which to focus the next steps. Such sustainability risks will
be part of that list.
N° Risk description ESG-related
Priority
current year
Changes
from previous year
1
Timely development of innovative and eco-responsible
products and technologies, supporting new mobility
solutions in the automotive industry
Yes High New risk
2
Dependence on key critical suppliers that are in a single
sourcing relation and/or not financially reliable that
could compromise the business operations
- Medium Confirmed
3
Unfavourable change in public opinion regarding
organisation's product due to perception it is no longer
green or sustainable.
Yes Medium No change

18
Risk Assessment and Treatment
The risk assessment phase aims at estimating the potential
exposure of a risk by quantifying its likelihood and impact. With
regards to sustainability, the assessment must be broader.
It must also consider the potential effects on the company’s
stakeholders, the reputation of the company and its longevity.
Matching the risks and possible impacts to the strategic
objectives of the company is fundamental in the area of
sustainability. This also requires the strategic objectives to be
clear!
From our discussions with risk managers, we see that a key
impediment to getting the risk assessment right at this stage
is a shortage of precise information. While you could argue
that there is more information available on sustainability than
ever before, the trick is finding the specific information that
is going to tell you most about that risk. It may be relatively
straightforward to assess the short-term consequences of
some risks, such as a fire in a factory, but secondary impacts
can be difficult to quantify.
The risk management function can be the centre of
competence for risk assessment and treatment drawing on
other expertise within the organisation and reducing silos.
Improving cross-function collaboration may involve building
stronger relationships with other functions, such as research
and development and engineering, etc.
If need be, the risk scoring scales defined in the ERM framework
should be revised to provide more weight to those longer-term
risks.

19
Some examples of approaches to sustainability risk assessment
ESG Risk Analysis Approach Output
Risk of business
interruption due
to extreme events
(e.g., floods,
cyclones, etc.)
on key company
assets
Objective: Identify the key/strategic production plants potentially exposed
to extreme weather events and evaluate the related resilience level.
How: Using a specialised weather forecast service and related modelling
of the evolution of natural catastrophic risks (NatCat) on a worldwide scale,
it is possible to match the geographical location of each production plant
with the NatCat exposure.
Each plant and specific NatCat risk should be evaluated along with the
existing counter-measures that could mitigate the consequences (e.g., site/
buildings elevation, presence of underground floors, etc.). Finally estimate
the potential business interruption in case of risk occurrence.
Note – A second level of analysis, more structured and locally managed,
could be useful, depending on available resources, to evaluate potential
consequences on the company supply chain, availability of roads and
transport, etc.
• List of production plants
potentially exposed to
specific NatCat risks.
• List of existing
countermeasures
mitigating the risk
exposure
• Business interruption
estimate (economic
impact)
• Action plan with further
countermeasures to
implement
Social uprising/civil
disobedience in
multiple countries
(inspired by
France’s Gilets
Jaunes, for
example)
Objective: Identify any concrete effects in terms of people, business
operations and company performance that this kind of event could
generate.
How: Map the potentially affected company perimeter (e.g., locations,
countries, number of involved employees, expected timing, etc.).
Define a risk scenario estimating the potential interruptions to business,
key possible physical impacts to physical infrastructure and supply chain,
and quantification of related economic-financial losses and any indirect
effect. Map any existing/timely implemented countermeasures, such
as business contingency plan, adoption of teleworking / health & safety
arrangements, etc.
• Map of company perimeter
potentially exposed to risk
• List of existing
countermeasures
mitigating the potential risk
exposure
• Risk estimate (economic/
financial impact and any
other indirect effects)
• Action plan with further
countermeasures to
implement

20
1. They can become part of regular risk reporting to top
management and the board of directors
› the responsible committee at working-level (which may be
audit, risk, governance or CSR) will analyse sustainability topics
with a view to making the sustainability risks relevant to the
overall strategic direction of management and the board.
2. Sustainability risk could be treated separately until it
becomes more understood within the organisation
› for consideration is to have a different report for the
sustainability-type risks to raise attention to them. A
pitfall here could be that it creates reporting overlap.
3. They will be input for sustainability self-assessment
questionnaires, such as for the Carbon Disclosure
Project, that require companies to describe the main
risks and opportunities with regard to ESG topics.
› Negative events may be at the same time translated in
business opportunities. For example, the development of
disruptive technological innovation and a consequent loss of
market share could generate an opportunity to invest in other
innovations that increase volumes, margins and market share.
4. They will be disclosed in the Non-Financial Reporting
Statement and used as input to the materiality
assessment process.
› identified ESG risks can be associated with specific ESG
aspects, then subject to a materiality evaluation in compliance
with the EU Non-Financial Reporting Directive.
Risk reporting, Communication and Disclosure
How do you report, and what do you report normally? Communication and collaboration are vital. A pre-requisite is to create and
use a common language. This starts with fundamental questions such as what is sustainability to your organisation and what is a
sustainability risk?
These terms must then be defined within the context of a methodology and framework, such as by integrating ESG-related risk
assessment into a consolidated ERM framework. To create coherence, the company’s sustainability goals should be mapped with
the risk framework across the enterprise.
The results of sustainability risk assessment can be communicated for different purposes:

21
FERMA SUSTAINABILITY COMMITTEE MEMBERS
Chair
Valentina
Paduano, ANRA
Tapio Huovinen,
FINNRIMA
Leopold Larios,
AMRAE
Maria Isabel
Martinez Torre-
Enciso, AGERS
Maja Sustersic,
SI.RISK
Zhetcho Kalitchin,
BRIMA
Mario Ramírez
Ortúzar, AGERS
Adriana Cavaliere,
BELRIM
Nataliya Todorova,
AIRMIC
Annemarie
Schouw, NARIM
Alberino
Battagliola, ANRA
Secretariat
Typhaine
Beauperin, FERMA
Adri van der Waart,
NARIM
Philippe Noirot,
AMRAE
Secretariat
Charles Low,
FERMA

22
REFERENCES
Page 3
FERMA COVID-19 Report 2020
https://www.ferma.eu/publication/covid-19-ferma-survey-
shows-risk-managers-contributions-to-response-and-resilie
nce/
FERMA European Risk Manager Report 2020
https://www.ferma.eu/publication/the-european-risk-
manager-report-2020-key-findings/
Page 4 in the green box
World Business Council for Sustainable Development
(WBCSD) and COSO, Applying Enterprise Risk Management to
Environmental, Social and Governance-related Risks
https://www.wbcsd.org/Programs/Redefining-Value/Business-
Decision-Making/Enterprise-Risk-Management/Resources/
Applying-Enterprise-Risk-Management-to-Environmental-
Social-and-Governance-related-Risks
Task Force on Climate-Related Financial Disclosures (TCDF),
Recommendations on the Task Force on Climate-related
Financial Disclosures https://www.fsb-tcfd.org/
ISO 31000 ‘Risk Management’ https://www.iso.org/iso-31000-
risk-management.html
ISO 26000 ‘Social Responsibility’ https://www.iso.org/iso-26000-
social-responsibility.html
Page 5
UN Sustainable Development Goals, https://sdgs.un.org/goals
European Green Deal https://ec.europa.eu/info/strategy/
priorities-2019-2024/european-green-deal_en
European Climate Law https://ec.europa.eu/info/law/better-
regulation/have-your-say/initiatives/12108-Climate-Law
Overview of sustainable finance, https://ec.europa.eu/info/
business-economy-euro/banking-and-finance/sustainable-
finance/overview-sustainable-finance_en
Page 6
Directive 2014/95/EU of the European Parliament and of the
Council of 22 October 2014 amending Directive 2013/34/EU as
regards disclosure of non-financial and diversity information by
certain large undertakings and groups Text with EEA relevance
(aka the NFRD) https://eur-lex.europa.eu/eli/dir/2014/95/oj
EU taxonomy for sustainable activities https://ec.europa.
eu/info/business-economy-euro/banking-and-finance/
sustainable-finance/eu-taxonomy-sustainable-activities_en
European Commission’s public consultation on Sustainable
Corporate Governance, https://ec.europa.eu/info/law/better-
regulation/have-your-say/initiatives/12548-Sustainable-
corporate-governance/public-consultation
PACTE, the Action Plan for Business Growth and Transformation,
https://www.gouvernement.fr/en/pacte-the-action-plan-for-
business-growth-and-transformation
OECD Due Diligence Guidance for Responsible Business
Conduct https://www.oecd.org/investment/due-diligence-
guidance-for-responsible-business-conduct.html
Questions and answers: The Recovery and Resilience Facility
https://ec.europa.eu/commission/presscorner/detail/en/
qanda_21_481
Page 7
MSCI, ESG 101: What is ESG? https://www.msci.com/our-
solutions/esg-investing/what-is-esg

Further reading:
European Parliament ‘Environment policy: general principles
and basic framework’ https://www.europarl.europa.eu/
factsheets/en/sheet/71/environment-policy-general-principles-
and-basic-framework
NGFS ‘first comprehensive report: a call for action’ https://www.
ngfs.net/en/first-comprehensive-report-call-action
BaFin ‘The Guidance Notice on Dealing with Sustainability Risks’
https://www.bafin.de/SharedDocs/Veroeffentlichungen/EN/
Meldung/2019/meldung_191220_MB_Nachhaltigkeitsrisiken_
en.html
OECD Business and Finance Outlook 2020: Sustainable
and Resilient Finance, Chapter 3 “Corporate governance
and the management of ESG risks” https://www.oecd-
ilibrary.org/sites/306482b9-en/index.html?itemId=/content/
component/306482b9-en#section-d1e5121
Schulte, Jesko and Sophie I. Hallstedt ‘Company Risk
Management in Light of the Sustainability Transitition’ from
Sustainability journal Sustainability 2018, 10, 4137; doi:10.3390/
su10114137
CRO Forum ‘The heat is on: Insurability and Resilience in a
Changing Climate’ https://www.scor.com/en/download/

Published in 2021, Brussels. © FERMA. All rights reserved.
Any reproduction in full or in part must mention the title and credit FERMA as the copyright owner.
Federation of European Risk
Management Associations
Federation of European Risk Management Associations Avenue de
Tervuren 273 B12 - 1150 Brussels (BELGIUM)
Tel: +32 2 761 94 32 - Email: enquiries@ferma.eu
www.ferma.eu

People, Planet & Performance: sustainability guide for risk and insurance managers

More Related Content

What's hot

Similar to People, Planet & Performance: sustainability guide for risk and insurance managers

More from FERMA

Recently uploaded

People, Planet & Performance: sustainability guide for risk and insurance managers