Skip to content

Environmental, Social and Governance (ESG) - Principles and Practice · Risk Management

ESG Risks and Climate Risk Management Explained

Updated 11 October 2026 · Fact-checked

ESG risks are threats to a company from environmental, social and governance factors. Climate risk has two types: physical (floods, heat, storms) and transition (policy, technology, market shifts). To solve a question, identify the risk, classify it, assess likelihood and impact, treat it, and embed it in enterprise risk management with board oversight.

Understand ESG Risks and Climate Risk Management

A risk is an uncertain event that can affect your objectives. ESG risks are risks that arise from environmental, social and governance matters. They can hurt cash flows, reputation, licence to operate and access to capital.

Environmental risks include pollution, water scarcity, waste, biodiversity loss and climate change. Social risks include unsafe workplaces, labour disputes, human rights issues in the supply chain, data privacy failures and community opposition to projects. Governance risks include weak board oversight, fraud, bribery, related-party abuse, poor disclosure and non-compliance.

Climate risk is the best-known environmental risk. It is split into two groups. Physical risks come from the climate itself. They are acute (cyclones, floods, heatwaves) or chronic (rising temperature, sea-level rise, long-term water stress). They damage assets, stop operations and disrupt supply chains. Transition risks come from the shift to a low-carbon economy. They include carbon pricing, tighter emission rules, new technology, changing customer preference and reputational damage. Climate change can also create liability risk, where a company faces claims for harm or for misleading green claims.

The TCFD (Task Force on Climate-related Financial Disclosures) recommendations ask companies to disclose in four areas: governance (board and management oversight), strategy (risks, opportunities and resilience under different scenarios), risk management (how climate risks are identified, assessed and integrated into overall risk management) and metrics and targets (emissions and goals). Use this four-part structure in answers.

Integration means ESG risks should not sit in a separate silo. They should be placed in the company's enterprise risk management (ERM) process: in the risk register, with owners, risk appetite, controls, monitoring and reporting to the board or its risk committee. Many ESG risks are also material to investors, so they link to disclosures such as BRSR.

Key rules to remember

Risk rating
Risk score = Likelihood × Impact
Use the same scale (for example 1 to 5) for every risk so that ESG risks can be ranked beside financial risks.
Climate risk classification
Climate risk = Physical risk (acute + chronic) + Transition risk (policy + technology + market + reputation)
A memory aid for classification, not a numeric formula. Always place each example under one head.
TCFD four pillars
Governance → Strategy → Risk management → Metrics and targets
Use as the answer skeleton for any climate disclosure or integration question.
Risk treatment options
Avoid / Reduce (mitigate) / Transfer / Accept
Pick the option that matches the risk and justify it.

How to solve ESG Risks and Climate Risk Management questions

Use this order for any case or theory question on ESG or climate risk. It keeps the answer in the provision, analysis, conclusion pattern.

  1. 1Read the facts and list each event that could harm the company.
  2. 2Classify each as environmental, social or governance. For climate, say physical (acute or chronic) or transition.
  3. 3Explain why it matters to this company: assets, cost, revenue, reputation, legal exposure.
  4. 4Assess likelihood and impact, and rank the risks.
  5. 5Recommend treatment: avoid, reduce, transfer or accept, with specific actions such as scenario analysis, insurance, supplier audits or a transition plan.
  6. 6Show integration: risk register, owners, risk appetite, internal controls, monitoring and board or risk committee oversight.
  7. 7Link to disclosure using the TCFD four pillars or BRSR, and add the role of the company secretary.
  8. 8Close with a clear conclusion that answers the question asked.

Quickest way: Classify, rank, treat, embed

When to use it: Use when time is short or the question asks you to list or explain risks with examples.

  1. Write the heads: E, S, G. Under climate write physical and transition.
  2. Give one fact-based example under each head.
  3. Add one line each on impact and treatment.
  4. Finish with two lines on ERM integration and TCFD pillars.
  5. Check that each example sits under the correct head.

Common mistakes in ESG Risks and Climate Risk Management

  • Calling a carbon tax or new emission rule a physical risk.

    Students link all climate risk to weather.

    Fix: Ask whether the cause is the climate itself (physical) or the response to climate change (transition).

  • Treating ESG risk as a separate exercise from ERM.

    ESG is seen as a reporting task.

    Fix: State that ESG risks go into the same risk register, rating scale, ownership and board reporting as other risks.

  • Listing risks without impact or treatment.

    Students memorise lists.

    Fix: For every risk add why it matters and one mitigation step.

  • Ignoring governance and social risks when the question says ESG risks.

    Climate dominates the topic.

    Fix: Cover all three heads, even briefly.

  • Naming TCFD pillars incorrectly or mixing them with BRSR sections.

    Both frameworks are disclosure-based.

    Fix: Remember the four TCFD pillars: governance, strategy, risk management, metrics and targets.

  • Giving generic answers not tied to the facts.

    The paper is case-based but students write textbook notes.

    Fix: Use the company's industry, location and facts in each point.

Worked examples

Example 1

Sunrise Textiles Ltd has dyeing units on a river bank in Gujarat. Flooding damaged a plant last year. The government proposes stricter effluent norms and a carbon price. Classify the climate risks and suggest how the board should manage them.

Show the solution
  1. Flood damage to the plant is a physical risk, specifically acute, as it comes from an extreme weather event.
  2. Stricter effluent norms and a carbon price are transition risks, specifically policy and legal.
  3. Impact: flooding can stop production and damage assets; new norms raise compliance and operating cost and may need new treatment technology.
  4. Treatment of physical risk: relocate or raise critical equipment, improve drainage, take property and business interruption insurance, build a business continuity plan.
  5. Treatment of transition risk: invest in effluent treatment and energy efficiency, plan for a carbon cost in budgets, run scenario analysis.
  6. Integration: record both risks in the ERM register with owners and ratings, set risk appetite, and report to the risk committee and board periodically.
  7. Disclosure: report through the TCFD pillars of governance, strategy, risk management and metrics and targets.

Answer: The flood is an acute physical risk. The effluent norms and carbon price are policy transition risks. The board should treat each with specific measures, record them in the ERM register, and oversee and disclose them using the TCFD structure.

Example 2

Explain how a listed company can integrate ESG risks into its enterprise risk management framework.

Show the solution
  1. Identify ESG risks across environmental, social and governance heads, using stakeholder engagement and a materiality assessment.
  2. Add them to the risk register with the same likelihood and impact scale used for other risks, so they can be ranked together.
  3. Assign a risk owner for each risk and set risk appetite and tolerance limits.
  4. Choose treatment: avoid, reduce, transfer or accept, with controls and key risk indicators such as emission intensity or injury rate.
  5. Use scenario analysis for climate risks to test resilience under different pathways.
  6. Set governance: the board or its risk committee oversees ESG risks, and management reports regularly.
  7. Disclose material risks and the approach, for example through the TCFD pillars and BRSR, and review the framework periodically.

Answer: ESG risks are integrated by identifying them through materiality, rating them on the common ERM scale, assigning owners and limits, applying treatments and indicators, using climate scenarios, giving the board oversight, and disclosing and reviewing them regularly.

Exam tips

  • Always classify before you explain. Marks go to correct heads: E, S, G and physical or transition.
  • Use facts from the case in every example; generic lists score low.
  • Keep the TCFD four pillars ready as a framework for strategy and disclosure questions.
  • Link the answer to ERM, board oversight and the company secretary's role in compliance and reporting.
  • End with a short conclusion that answers the exact question asked.

Practice questions from Risk Management

ESG Risks and Climate Risk Management in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

ESG Risks and Climate Risk Management: frequently asked questions

What is the difference between physical risk and transition risk?

Physical risk comes from climate impacts such as floods, heatwaves or sea-level rise. Transition risk comes from the move to a low-carbon economy through policy, technology, market and reputation changes.

What are the four TCFD recommendation areas?

They are governance, strategy, risk management, and metrics and targets. Together they guide how a company discloses climate-related risks and opportunities.

How do you integrate ESG risks into ERM?

Add ESG risks to the common risk register, rate them on the same scale, assign owners, set appetite, apply controls and indicators, and report to the board. Review them regularly.

Are social and governance matters also risks?

Yes. Labour disputes, supply chain human rights issues, data breaches, fraud and bribery can all cause financial loss, penalties and reputational damage, so they belong in the risk register.