Applying Enterprise Risk Management to Environmental, Social, and Governance-Related Risks

• Sanitation and

hygiene

• Agricultural sourcing

• Human rights

• Climate action

• Deforestation

• Packaging and waste

• Water

• Non-agricultural

sourcing

• Women’s rights and

opportunities

• Economic inclusion

• Employee well-being

• Fair compensation

• Ethics, values

and culture

• Data security

and privacy

• Trusted products and

ingredients

• Animal testing and

welfare

• Governance and

accountability

• Consumers and

sustainability

• Responsible marketing

• Talent

• Communicable

diseases

and advertising

• Tax and economic

contribution

• Responsible use of

innovation and

technology

Why do environmental, social and governance-related risks matter

for organizations?

ESG-related risks are not necessarily new. In particular, corporations, organizations, governments and investors

have been considering governance risks for many years, focusing on aspects such as financial accounting and

reporting practices, the role of board leadership and composition, anti-bribery and corruption, business ethics,

and executive compensation.

However, over the last several decades – and particularly the last 10 years – the prevalence of ESG-related risks

has accelerated rapidly. In addition to a clear rise in the number of environmental and social issues that entities

now need to consider, the internal oversight, governance and culture for managing these risks also require

greater focus.

The evolving global risk landscape

Each year, the World Economic Forum’s Global Risks Report6 surveys business, government, civil society and

thought leaders to understand the highest rated risks in terms of impact and likelihood. Over the last decade,

these risks have shifted significantly. In 2008, only one societal risk, pandemics, was reported in the top five

risks in terms of impact. In 2018, four of the top five risks were environmental or societal, including extreme

weather events, water crises, natural disasters, and failure of climate change mitigation and adaptation.

The World Economic Forum also highlights the increasing interconnectedness among ESG risks themselves,

as well as with risks in other categories – particularly the complex relationship between environmental risks or

water crises and social issues such as involuntary migration.

In the business world, this evolving landscape means ESG-related risks that were once considered “black

swans”c are now far more common – and can manifest more quickly and significantly. A report by the Society

for Corporate Governance7 in the United States found that these issues often, although not always:

• Derive from a risk or impact inherent in the core operations or products

• Have the potential to meaningfully damage a company’s intangible value, reputation or ability to operate

• Are accompanied by persistent media interest, organized stakeholders and associated public policy debates

that could magnify the impact of a company’s existing position or practice and increase the reputational risk

(or opportunity) created by a change in company policy or practice

. . . . . . . . . . . . . . . .

c The black swan theory was developed by Nassim Nicholas Taleb, who describes it as "first, it is an outlier, as it lies outside the realm of regular expectations, because

nothing in the past can convincingly point to its possibility. Second, it carries an extreme impact. Third, in spite of its outlier status, human nature makes us concoct

explanations for its occurrence after the fact, making it explainable and predictable.” For more information, refer to the 2007 New York Times article “The Black Swan:

The Impact of the Highly Improbable.”

2

Enterprise Risk Management | Applying enterprise risk management to environmental, social and governance-related risks • October 2018Introduction

An illustration of this is JBS SA’s (JBS) experience between 2015 and 2017. JBS is the world’s largest meat

company by revenue, capacity and production across poultry, lamb and pork. Beginning in late 2015 and

continuing into June 2017, successive allegations of meat contaminations, corruption, deforestation, slave

labor and fraud were levied against JBS as part of several extensive and ongoing probes centered on the

meatpacking industry, and JBS in particular. Ultimately, JBS faced material financial impacts, including a loss

of equity value of 31%. While the most direct impact resulted from weak governance, the challenges were

exacerbated by a series of complex and interconnected ESG-related challenges, reflected in declining investor

and consumer interest in international markets that prioritize ESG concerns.8

JBS’s experience is not unique. Figure 1 outlines the growing pace with which other organizations have failed

to manage ESG issues, leading to impacts on reputation, customer loyalty and financial performance. In many

cases, the media, social media and other non-governmental organization campaigns play a role in bringing

these issues to the attention of civil society and the organization.

Figure 1: Examples of organizations that have experienced ESG-related impacts

Nike was accused

of employing

children and paying

workers less than

minimum wage

1990s

BP’s oil rig

Deepwater Horizon

explodes, killing 11

workers, injuring 17

and creating an

environmental

disaster

2010

Building collapse

kills more than

1,100 workers in

Bangladesh’s Rana

Plaza factory used

by 25+ brands

2013

Millions of

Volkswagen cars

recalled after

the company

admitted to

falsifying

emissions tests

2015

After the death

of a 20-year-old

fraternity pledge,

Florida State

University

suspended

fraternities

and sororities

2017

Wells Fargo

created

millions of

accounts in

the names

of its clients

without their

permission

2018

1980s

Boycott against

Nestlé for

marketing baby

formula in

emerging

countries

2011

Flooding in

Thailand resulted

in disruptions

to automotive

and technology

supply chain

networks

2000s

Mattel recalled

967,000 products

due to lead paint

contamination

2014

Drinking water

in Flint, MI

found with

dangerous

levels of lead

2016

Samarco

(Vale and BHP)

dam collapse kills 19

and sends iron ore

debris through

southeast

Brazil

2018

Oxfam faces

alleged

cover-up

of sexual

harassment

scandal

in Haiti

2015

3M suppliers

allegedly provide

products from

endangered forests

2017

Uber faces sexual

harassment scandal

leading to a

#DeleteUber movement

When incidents related to pollution, customer and employee safety, ethics and management oversight have

such dramatic impacts on market prices, it becomes clear that ESG issues are business issues and that their

near-term market impacts reflect anticipated long-term effects on cash flows and associated risks.

Investor interest in ESG-related risks

There is also growing interest from investors seeking to understand how organizations are identifying and

responding to ESG-related risks.9 In recent years, environmental and social proposals in the US have accounted

for around half of all shareholder proposals submitted – representing the largest category of proposals (the

other categories include board, anti-takeover/strategic, compensation or routine/other).d

In 2018, shareholder proposals on environmental and social topics that reached a vote included high-profile

topics such as political spending and lobbying, greenhouse gas emissions, sustainability reporting, diversity

and inclusiveness, human rights, gun control, and prescription drugs. Governance-focused shareholder

proposals related to board matters such as director elections and executive and director compensation.

The growing level of investor support for environmental issues has been notable; for example, in recent years,

climate-related proposals received majority support of votes cast at large-cap companies such as ExxonMobil,

Occidental Petroleum, PPL Corporation and Anadarko.10

. . . . . . . . . . . . . . . .

d Although average support for environmental and social proposals has been on the rise, a significant number (around one-third) are typically withdrawn from

proxy ballots and addressed through company-investor engagement, robust dialogue and company action. Based on governance data of more then 3,000 US public

companies. Includes data up to August 31, 2018.

3

Enterprise Risk Management | Applying enterprise risk management to environmental, social and governance-related risks • October 2018Introduction

These proxy voting results are not surprising given the growing attention by large institutional investors to

responsible investing and how companies are addressing social and environmental challenges to achieve

long-term, sustained growth.e Once limited to a small set of investors, the focus on ESG investing has expanded

to mutual funds, exchange-traded funds and private equity. The largest passive investors globally, including

BlackRock, which has USD$6.3 trillion in assets under management, State Street Global Advisors

(USD$2.8 trillion) and the Government Pension Fund of Japan (USD$1.4 trillion), have embraced purpose and

ESG considerations in their investing, engagement, risk management practices and marketing practices.11

“A company’s ability to manage environmental, social and governance matters demonstrates the

leadership and good governance that is so essential to sustainable growth, which is why we are increasingly

integrating these issues into our investment process. Companies must ask themselves: What role do we

play in the community? How are we managing our impact on the environment? Are we working to create

a diverse workforce? Are we adapting to technological change? Are we providing the retraining and

opportunities that our employees and our business will need to adjust to an increasingly automated world?

Are we using behavioral finance and other tools to prepare workers for retirement, so that they invest in a

way that will help them achieve their goals?”12

Larry Fink, CEO BlackRock, 2018

ESG disclosures and regulation

Sustainability reporting has become a norm for many public and private companies. Non-profits and public

entities have also started to disclose ESG information to their stakeholders.f Most entities face some level of

investor, customer and/or supplier demand for more transparency about ESG issues, particularly those related

to questions around supply chain integrity, board diversity or climate change adaptation. In 2018, 85% of all

S&P 500 companies produced some type of ESG disclosure.13

There has also been growth in ESG-related regulation and disclosure requirements – totaling 1,052

requirements (80% of which are mandatory) in 63 countries.g From 2017, the European Union Directive on

Non-Financial Reporting requires that companies that operate in EU member states and meet certain criteria

prepare a statement containing information relating to environmental protection, social responsibility and

treatment of employees, respect for human rights, anti-corruption and bribery, and diversity on boards.

Regulatory bodies and stock exchanges are also responding to growing investor demands for uniform ESG

information linked to financial performance.

In 2017, Singapore introduced a listing rule for listed issuers to prepare an annual sustainability report,

identifying material ESG factors, policies, practices, performance, targets and a board statement.14 NASDAQ’s

Nordic and Baltic exchanges issued voluntary guidance in March 2017.15

The Recommendations of the Task Force for Climate-related Financial Disclosures (TCFD)16 are a significant

step to support preparedness in the transition to a low-carbon economy and against anticipated increases in

the frequency or intensity of extreme climate events. Drawing on numerous guidance documents, initiatives,

reporting and risk management mechanisms, the TCFD has issued recommendations on climate-related risks

that can be applied to corporations and other entities.

. . . . . . . . . . . . . . . .

e An EY survey revealed that more than 80% of institutional investors surveyed agreed that for too long, companies have failed to consider environmental and social

risks and opportunities as core to their business. They believe that ESG issues have “real and quantifiable impacts” over the long term and that generating sustainable

returns over time requires a sharper focus on ESG factors. For more information, refer to the 2017 EY report “Is your nonfinancial performance revealing the true value

of your business to investors?”

f Some examples include the DMCC (Free Zone and Government of Dubai Authority on commodities trade and enterprise), Eskom, NASA, NASDAQ, Oxfam and WWF.

g These countries include Argentina, Australia, Austria, Bangladesh, Belgium, Bolivia, Brazil, Canada, Chile, China, Colombia, Costa Rica, Croatia, Czech Republic,

Denmark, Ecuador, El Salvador, Finland, France, Germany, Greece, Guatemala, Honduras, Hong Kong, Hungary, India, Indonesia, Ireland, Israel, Italy, Japan,

Kazakhstan, Luxembourg, Malaysia, Mexico, Myanmar, Netherlands, New Zealand, Nigeria, Norway, Panama, Paraguay, Peru, Philippines, Poland, Portugal, Romania,

Russia, Singapore, Slovakia, South Africa, South Korea, Spain, Sweden, Switzerland, Taiwan, Thailand, Turkey, Ukraine, United Kingdom, United States, Uruguay and

Vietnam. For more information, refer to the Reporting Exchange at reportingexchange.com/

4

Enterprise Risk Management | Applying enterprise risk management to environmental, social and governance-related risks • October 2018Introduction

Comparing ESG disclosures to risk disclosures

Despite an increase in ESG disclosures, evidence shows that the issues reported in sustainability reports

or ESG disclosures do not always align to the risks reported in an organization’s risk disclosures. WBCSD

member companies point to a range of reasons for this, including:

• The challenge of quantifying ESG-related risks in monetary terms. Not doing so makes prioritization

and appropriate allocation of resources much more difficult, particularly when the risk is long term with

uncertain impacts emerging over an unknown time period.

• Lack of knowledge of ESG-related risks across the entity and limited cross-functional collaboration

between risk management and sustainability practitioners.

• ESG-related risks are managed and disclosed by a team of sustainability specialists and viewed as

separate or less significant than conventional strategic, operational or financial risks – leading to a

range of biases against ESG-related risks.

Refer to Sustainability and ERM: The first step towards integration17 for more information or Appendix I

for a summary of this research.

How can ERM help risk management and sustainability practitioners navigate

ESG-related risks?

There is a case to be made for entities taking a more active role in understanding and addressing ESG-related

risks – whether that means reducing or removing risk, adapting and preparing for risk or being more transparent

about how the organization is addressing risk.

The COSO ERM Framework defines ERM as “the culture, capabilities and practices, integrated with

strategy-setting and performance, that organizations rely on to manage risk in creating, preserving and

realizing value.”18

Many entities have ERM structures and processes in place to identify, assess, manage, monitor and

communicate risks. Even in the absence of a formalized ERM function, roles and responsibilities for risk

management activities across the business are often defined and executed.h These processes provide a path

for boards and management to optimize outcomes with the goal of enhancing capabilities to create, preserve

and ultimately realize value.19 While there are many choices in how management will apply ERM practices and

no one better approach is universally better than another, research has shown that mature risk management

can lead to higher financial performance.i

Leveraging these structures and processes can also support organizations to identify, assess and respond to

ESG-related risks. Given ESG-related risks can be complex or unfamiliar to organizations, COSO and WBCSD

have developed guidance to support entities to better understand and manage the full spectrum of

ESG-related risks.

. . . . . . . . . . . . . . . .

h A 2017 report by the AICPA that surveyed 432 executives across large organizations, public companies, financial services and not-for-profit organizations found that

28% of organizations have a “complete formal enterprise-wide risk management process in place” while 37% have a “partial enterprise-wide risk management process

in place (i.e., some, but not all, risk areas addressed). (Beasley, M., Branson, B., & Hancock, B. (2017, March). “The state of enterprise risk oversight: an overview of risk

management practices 8th edition.”)

i For example, a 2013 study by EY found that companies with mature risk management practices outperformed their competitors financially. Companies that ranked

in the top 20% in terms of risk management maturity reported earnings three times higher than companies in the bottom 20%. (EY (2013). “Turning risk into results: how

leading companies use risk management to fuel better performance.” p. 3) A 2014 study found that “firms with advanced levels of ERM implementation present higher

performance, both as financial performance and market evaluation.” (Florio, C. and Leoni, G. (2017). “Enterprise risk management and firm performance: The Italian case”

British Accounting Review 49. p. 56-74)

5

Enterprise Risk Management | Applying enterprise risk management to environmental, social and governance-related risks • October 2018Introduction

About this guidance – audience

This guidance is designed to be used by any entity facing

ESG-related risks – including startups, non-profits, for-profits, large

corporations or government entities. The intended audience includes

any decision-makers as well as risk management and sustainability

practitioners who are looking for guidance on managing

ESG-related risks. The audience may include those positioned in

an ERM or sustainability function or with oversight responsibilities of

those functions, but may also include any risk owner or operations

manager whose roles are impacted by ESG-related risks – whether a

procurement manager, an analyst in investor relations or a marketing

director. The intended audience and their application of this guidance

may be described as follows:

Everyone has the responsibility

to manage risk. While many

ESG risks will be owned by the

ESG or sustainability team – as

stated by Larry Fink, “We want

ESG risk management to be

a tool that every manager is

looking at.”

• Decision-makers: The guidance generates awareness that ESG is a mainstream topic encompassing a wide

range of issues that require effective oversight and decision-making.

• Risk management practitioners: Risk management practitioners primarily include those with a direct

role in the ERM process; however, the guidance is applicable to anyone with responsibilities to manage risk

(including operational management, risk owners and line management). The guidance aims to help these

practitioners understand the types of ESG-related risks that may impact the entity along with tools, resources

and frameworks that can support further understanding.

• Sustainability practitioners: Sustainability practitioners primarily include those with a direct role

in a sustainability function; however, the guidance is applicable to anyone impacted by ESG-related

considerations. The guidance aims to help these practitioners integrate their knowledge and awareness of

ESG-related trends, issues, impacts and dependencies with ERM tools and processes to better support

identifying, defining, assessing, responding to and disclosing ESG-related risks.

In some cases, practitioners may hold more than one of these roles.

Application of this guidance to small and medium-sized enterprises (SMEs)j

ESG-related risks are as relevant for small and medium-sized entities as they are for large corporations or

government bodies. However, resources in SMEs are often limited, making it challenging for these entities

to establish robust governance or to adequately identify, assess and respond to all ESG-related risks.

SMEs should take a common sense approach that uses available resources efficiently. This may include

focusing on strategy and objective-setting and performance (Chapters 2 and 3) while being aware of the

importance of continual monitoring and improvement (Chapter 4).

About this guidance – purpose and scope

Purpose

The purpose of the guidance is to help organizations apply ERM principles and practices to ESG-related risks.

To this extent, the guidance applies COSO’s ERM Framework Enterprise Risk Management—Integrating with

Strategy and Performance.20

. . . . . . . . . . . . . . . .

j This is defined by the European Union as companies with less than 250 employees.

6

Enterprise Risk Management | Applying enterprise risk management to environmental, social and governance-related risks • October 2018IntroductionFigure 2: COSO’s Enterprise Risk Management Framework

MISSION, VISION

& CORE VALUES

STRATEGY

DEVELOPMENT

BUSINESS

OBJECTIVE

FORMULATION

IMPLEMENTATION

& PERFORMANCE

ENHANCED

VALUE

GOVERNANCE

& CULTURE

STRATEGY &

OBJECTIVE-SETTING

PERFORMANCE

REVIEW

& REVISION

INFORMATION,

COMMUNICATION

& REPORTING

6. Analyzes Business

10. Identifies Risk

15. Assesses Substantial

18. Leverages

1. Exercises Board

Risk Oversight

Context

11. Assesses Severity

2. Establishes Operating

7. Defines Risk Appetite

of Risk

Structures

8. Evaluates Alternative

12. Prioritizes Risks

3. Defines Desired Culture

Strategies

13. Implements Risk

4. Demonstrates

Commitment to Core

Values

5. Attracts, Develops and

Retains Capable

Individuals

9. Formulates Business

Responses

Objectives

14. Develops

Portfolio View

© 2017 COSO. Used by permission. All rights reserved.

Change

16. Reviews Risk

and Performance

17. Pursues Improvement

in Enterprise Risk

Management

Information

and Technology

19. Communicates

Risk Information

20. Reports on Risk,

Culture and

Performance

While the guidance is aligned to COSO’s five components and 20 principles shown in Figure 2, it also offers a

practical approach to entities using other risk management frameworks, such as ISO 31000 or entity-specific

risk management frameworks. Wherever possible, this document leverages existing frameworks, guidance,

practices and tools from both the risk management and sustainability fields.k It is not intended to be used as

ERM guidance in isolation and should be used in conjunction with an established ERM framework.

The purpose of this guidance is to help an entity achieve:

• Enhanced resilience: An entity’s medium- and long-term viability and resilience will depend on the

ability to anticipate and respond to a complex and interconnected array of risks that threaten the strategy

and objectives.

• A common language for articulating ESG-related risks: ERM identifies and assesses risks for potential

impact to the strategy and business objectives. Articulating ESG-related risks in these terms brings ESG

issues into mainstream processes and evaluations.

• Improved resource deployment: Obtaining robust information on ESG-related risks enables management

to assess overall resource needs and helps optimize resource allocation.

• Enhanced pursuit of ESG-related opportunities: By considering both positive and negative aspects of

ESG-related risks, management can identify ESG trends that lead to new opportunities.

• Realized efficiencies of scale: Managing ESG-related risks centrally and alongside other entity-level risks

helps to eliminate redundancies and better allocate resources to address the entity’s top risks.

• Improved disclosure: Improving management’s understanding of ESG-related risks can provide the

transparency and disclosure investors expect and achieve compliance with jurisdictional reporting requirements.

. . . . . . . . . . . . . . . .

k Examples include the COSO Internal Control Integrated Framework, Global Reporting Initiative (GRI) Standards, the Greenhouse Gas Protocol, International Integrated

Reporting Council’s (IIRC) Integrated Reporting <IR> Framework, Natural Capital Protocol, Social & Human Capital Protocol, Sustainability Accounting Standards Board

(SASB) Standards, Recommendations of the Task Force on Climate-related Financial Disclosures (TCFD).

7

Enterprise Risk Management | Applying enterprise risk management to environmental, social and governance-related risks • October 2018Introduction

Scope of ESG-related risks

This document provides guidance for applying ERM processes to ESG-related risks. Relevant ESG-related

risks will depend on the organization, which may apply a narrow definition, focusing on a selection of pertinent

environmental or social risks, or a broad application that considers a myriad of issues, such as the MSCI issues

set out in Table 2.

Table 2: MSCI ESG issues and themes21

3 pillars

10 themes

37 ESG key issues

Environment

Climate change

Natural resources

Carbon emissions

Product carbon footprint

Water stress

Biodiversity and land use

Financing environmental impact

Climate change vulnerability

Raw material sourcing

Pollution and waste

Toxic emissions and waste

Packaging materiality and waste

Electronic waste

Environmental

opportunities

Opportunities in clean tech

Opportunities in green building

Opportunities in renewable energy

Social

Human capital

Product liability

Labor management

Health and safety

Product safety and quality

Chemical safety

Financial product safety

Human capital development

Supply chain labor standards

Privacy and data security

Responsible investment

Health and demographic risk

Stakeholder opposition

Controversial sourcing

Social opportunities

Access to communications

Access to finance

Access to health care

Opportunities in nutrition and health

Governance

Corporate governance

Board

Pay

Corporate behavior

Business ethics

Anti-competitive practices

Tax transparency

Ownership

Accounting

Corruption and instability

Financial system instability

Many of the governance (i.e., the “G”) issues listed in Table 2, such as ownership, accounting and

anti-competitive practices, have been long-standing issues for organizations and are generally

well managed in established ERM processes. This guidance therefore places greater focus on environmental

and social issues, which for some organizations have historically been managed outside the influence of

robust governance and ERM. The governance risks discussed throughout the guidance tend to focus on

either the governance of environmental or social issues, or other issues that have recently gained interest in

the business community such as business ethics or diversity on boards.

About this guidance – structure

The guidance has five chapters that mirror the five components of the COSO ERM Framework, starting with

Governance and culture and Strategy and objective-setting, then moving through the ERM process focusing

on Performance (identifying, assessing and prioritizing and for responding to ESG-related risks) and finally the

Review and revision and Information, communication and reporting for ESG-related risks.

1. Governance and culture for ESG-related risks: Governance, or internal oversight, establishes the manner

in which decisions are made and how these decisions are executed. Applying ERM to ESG-related risks

includes raising the board and executive management’s awareness of ESG-related risks – supporting a

culture of collaboration among those responsible for risk management of ESG issues.

2. Strategy and objective-setting for ESG-related risks: All entities have impacts and dependencies on

nature and society. Therefore, a strong understanding of the business context, strategy and objectives serves

as the anchor to all ERM activities and the effective management of risks. Applying ERM to ESG-related risks

includes examining the value creation process to understand these impacts and dependencies in the short,

medium and long term.

8

Enterprise Risk Management | Applying enterprise risk management to environmental, social and governance-related risks • October 2018Introduction3. Performance for ESG-related risks:

a) Identifies risk: Organizations use multiple approaches for identif...