What Keeps the Resilience Manager Awake? Integrating Climate Risk into Corporate Management Systems

Abstract

Climate risk does not require a new management system, but rather a new ability to integrate existing ones. Business Continuity, Enterprise Risk Management, ESG, Health & Safety, Property Loss Control, Facility Management, and Supply Chain already address different aspects of the same phenomenon, often without any real coordination. How can we build a truly integrated governance framework? What international standards can guide this process? And what are the first concrete steps every organization should take? In this in-depth analysis, we propose a practical approach to transforming climate risk into a structural element of corporate resilience, creating synergies among functions that, until now, have often operated separately.

—-

When a new governance issue arises, the most common reaction of organizations is to create a new process, a new committee, a new risk register, or a new dedicated function.

Given the climate risk, this would probably be the least effective choice.

Climate change, in fact, is not a risk in and of itself, but a factor capable of altering the probability, frequency, and impact of numerous risks already present within the organization. For this reason, it should be addressed as a cross-cutting issue, integrated into existing management systems, rather than as yet another organizational “silo.”

A risk that already exists… but is spread out

In most organizations, climate risk is already present, although often in a fragmented way.

TheESG and Sustainabilityfunction assesses environmental impacts, decarbonization goals, and reporting requirements.

TheHealth & Safetydepartment addresses the effects of heat waves on staff, operational restrictions during extreme weather events, and the measures needed to ensure safe working conditions.

Property Loss ControlandFacility Managementanalyze the vulnerability of buildings and facilities to floods, hailstorms, wildfires, extreme winds, high temperatures, and the availability of utility networks.

Risk Managementassesses the economic, insurance, and financial impacts of events.

Business Continuity Management, on the other hand, focuses on the operational consequences: unavailability of facilities, supply chain disruptions, staff absences, loss of essential services, power outages, supplier unavailability, and recovery times.

As a result, the same phenomenon is often addressed by different departments using different languages, tools, and priorities.

The real challenge, therefore, is not decidingwho should manage climate risk, buthow to coordinate all these areas of expertise within a single resilience framework.

International standards are moving in the same direction

International regulations and standards are also moving toward an integrated approach.

TheCSRDand theEuropean Sustainability Reporting Standards (ESRS)require companies to assess risks and opportunities related to climate change as part of their sustainability reporting.

TheEuropean Taxonomyintroduces the need to assess physical climate risks and adaptation measures for numerous economic activities.

TheISO 14090andISO 14091standards provide specific guidelines for climate adaptation and for assessing vulnerability to climate change.

Furthermore, starting in 2024, the amendments introduced by ISO to the major management systems—includingISO 22301—require organizations to assess whether climate change is a significant factor in their operating context.

It’s not about creating new systems.

The goal is to determine whether climate change alters the assumptions on which the risk assessment, business impact analysis, business continuity plans, and resilience strategies were based.

Where to start?

Many organizations can start with relatively simple but extremely effective measures.

For example:

• update the risk assessment by taking into account future climate scenarios, rather than relying solely on historical data;
• verify whether the Business Impact Analysis takes into account the impact of climate events on people, facilities, equipment, and suppliers;
• bring together Risk Management, Business Continuity, ESG, Health & Safety, Facility Management, Operations, and Procurement at a single working table;
• review emergency plans in light of heat waves, floods, hailstorms, wildfires, and prolonged disruptions to essential services;
• Reassess preventive investments (protective coverings, drainage systems, fire suppression systems, water reserves, electrical redundancies, cooling systems) using updated climate scenarios.

A Single Resilience

Climate risk demonstrates, more than any other issue, just how outdated the distinction between disciplines considered in isolation has become.

Organizational resilience, in fact, stems from the integration of diverse skills.

Business Continuity, Enterprise Risk Management, ESG, Property Loss Control, Health & Safety, Supply Chain Management, Facility Management, and Insurance Management are not alternative approaches, but complementary perspectives through which to view the same phenomenon.

The most resilient organizations will not be the ones that produce the greatest number of procedures dedicated to climate risk.

These will be the companies capable of integrating climate change into their day-to-day decisions, investment processes, plant design, supplier selection, asset protection, and business continuity planning.

For the Resilience Manager, this is likely to be the most significant challenge in the coming years: transforming what appears to be an environmental issue into a fundamental component of corporate governance, thereby helping to build an organization that is truly prepared to navigate an operating environment that is bound to undergo profound changes.

This post is also available in: