What are ESG risks, and why is it important to assess them?

Introduction to ESG Risks: Why They’re Being Discussed More and More

ESG risks are playing an increasingly central role in companies’ strategic, financial, and operational decisions.

This does not mean that sustainability has lost its ethical, environmental, and social dimensions. On the contrary: environmental protection, respect for people, quality of work, transparency, and sound governance remain fundamental aspects for any company that wishes to operate responsibly.

What’s new is that these issues are no longer viewed merely as values or principles, but also as factors that can affect business continuity, costs, access to credit, insurance terms, relationships with clients and investors, and the company’s competitiveness.

That is precisely why there is increasing talk of ESG risks.

An environmental, social, or governance risk is no longer just an issue to be included in a sustainability report; it can become a real economic risk.

Consider, for example, the rising cost of CO₂, new carbon pricing regulations, banks’ requirements regarding climate risks, ESG questionnaires sent by major clients, or the possibility that a supplier might be excluded from a supply chain because it is unable to demonstrate adequate environmental or social performance.

In this article, we’ll explore what ESG risks are, what categories exist, what concrete examples might apply to companies, and why it’s important today to assess, manage, and mitigate them in a structured way.

What Are ESG Risks? Definition and Meaning

ESG risks are events, conditions, or factors related to environmental, social, and governance issues that can have negative economic, operational, financial, regulatory, or reputational impacts on a company.

In other words, an ESG risk is a business risk linked to one or more sustainability factors.

This may include, for example:

• the company’s exposure to extreme weather events;
• the rise in costs associated with greenhouse gas emissions;
• dependence on critical raw materials;
• occupational health and safety issues;
• human rights violations in the supply chain;
• allegations of greenwashing;
• shortcomings in governance systems or internal controls.

The very fact that we speak of ESG “risks” is significant. It indicates that sustainability is no longer viewed merely as a set of good environmental or social practices, but also as a factor capable of influencing a company’s economic and financial performance.

For this reason, ESG risks are increasingly being analyzed using tools similar to those used for other business risks: identification, assessment of probability and impact, definition of mitigation measures, and monitoring over time.

Assessing these risks, however, can be more complex than assessing other traditional business risks. In fact, many ESG risks manifest over the medium to long term, depend on external variables that are difficult to control, and can affect not only the company but also its value chain, suppliers, clients, the local community, and regulatory developments.

“New ESG risks” are simply environmental, social, and governance risks that are now assessed more closely than in the past. These are not always new risks in an absolute sense: what is new is that banks, investors, insurance companies, clients, and European regulations are increasingly requiring companies to identify, measure, and manage them in a structured manner.

What types of ESG risks exist?

As the acronym ESG suggests, ESG risks can be divided into three broad categories:

• environmental risks;
• social risks;
• governance risks.

This classification is useful because it helps identify the risk factors to which the company is exposed and the areas that require closer scrutiny.

Environmental Risks

Environmental risks relate to the the relationship between the company and the natural environment.

They can stem both from the impacts the company has on the environment and from the company’s dependence on natural resources, climatic conditions, energy, raw materials, or ecosystem services.

Environmental risks include:

• greenhouse gas emissions;
• high energy consumption;
• dependence on fossil fuels;
• air, water, or soil pollution;
• inadequate waste management;
• water scarcity;
• dependence on critical raw materials;
• loss of biodiversity;
• exposure to extreme weather events.

An energy-intensive company, for example, may be exposed to the risk of rising energy costs or CO₂ costs. A company with facilities in flood-prone areas may be exposed to physical climate risks. A company that depends on raw materials that are rare or difficult to replace may experience supply disruptions or price increases.

In this context, the LCA methodology can provide very useful information. In fact, thanks to its in-depth analysis of impacts throughout the entire life cycle, LCA can provide a solid foundation for identifying the most critical stages.

Social Risks

Social risks affect people who are directly or indirectly involved in the company’s activities.

This may affect employees, suppliers, local communities, clients, and, more generally, all stakeholders who may be impacted by the company’s operations.

Social risks include:

• occupational health and safety;
• work-related injuries and illnesses;
• inadequate working conditions;
• discrimination;
• lack of diversity and inclusion;
• human rights violations;
• child labor or forced labor in the supply chain;
• conflicts with local communities;
• risks related to product safety;
• Inadequate handling of clients’ personal data.

For many companies, especially those involved in international supply chains, social risks are not limited to their own employees. They can also arise throughout the supply chain, among suppliers and subcontractors, and turn into reputational, commercial, or regulatory risks.

Governance Risks

Governance risks relate to the way the company is managed, supervised, and governed.

These risks are often less visible than environmental risks, but they can have very significant consequences.

Governance risks include:

• corruption;
• fraud;
• conflicts of interest;
• shortcomings in internal controls;
• regulatory violations;
• Inaccurate ESG disclosures;
• greenwashing;
• lack of transparency;
• inadequate cybersecurity management;
• a lack of clear roles and responsibilities in managing ESG issues.

A very current example is greenwashing. A company that reports environmental results not backed by solid or verifiable data may suffer reputational damage, face scrutiny from authorities, lose client trust, and encounter difficulties in its relationships with investors and stakeholders.

When it comes to environmental and compliance risks, an environmental management system based on ISO 14001 can serve as an important management foundation. It does not automatically eliminate ESG risks, but it helps the company address environmental issues, regulatory compliance obligations, roles, responsibilities, and continuous improvement processes. In this sense, it can help reduce the risk of noncompliance, penalties, or unstructured management of environmental issues.

Climate Risks: Physical Risks and Transition Risks

Among ESG risks, climate risks play a particularly important role.

The risks associated with climate change can, in fact, have direct economic impacts on businesses, both through physical events and through regulatory, technological, and market developments linked to the transition to a low-emission economy.

The two most commonly used broad categories for analyzing climate risk are:

• physical risks;
• transition risks.

Physical Risks of Climate Change

Physical risks stem from the physical effects of climate change.

They can be acute, when they are linked to extreme events, or chronic, when they result from gradual changes in climatic conditions.

Examples of physical hazards include:

• floods;
• drought;
• fires;
• heat waves;
• landslides;
• storms;
• sea-level rise;
• decrease in water availability;
• damage to facilities, warehouses, or infrastructure;
• logistics or supply chain disruptions.

For a company, these risks can result in production downtime, damage to assets, higher insurance costs, supply chain disruptions, or the need to invest in adapting production sites.

Managing physical climate risk therefore means understanding the extent to which a company is exposed to certain climate hazards and identifying actions that can increase the climate resilience of its facilities, processes, and supply chain.

Climate Transition Risks

Transition risks, on the other hand, stem from the shift toward a more sustainable, low-emission economy.

They may depend on:

• new environmental regulations;
• increase in the cost of CO₂;
• technological advancements;
• changes in client preferences;
• requests from banks and investors;
• competitive pressure;
• reporting requirements;
• exclusion from certain markets or supply chains.

In many cases, transition risks follow a very simple principle: companies that are less environmentally efficient may end up incurring higher costs.

This is where the issue of sustainability becomes immediately clear from an economic perspective as well: higher emissions, lower energy efficiency, limited adaptability, or a lack of reliable environmental data can lead to costs, constraints, or competitive disadvantages.

Examples of transition risks: ETS, ETS 2, and CBAM

Transition risks are among the most important to understand because they turn sustainability into a direct economic issue.

ETS: Those Who Emit More Pay More

The EU ETS, or European Union Emissions Trading System, is one of the clearest examples of transition risk.

The system covers several high-emission sectors, including energy and heat production, manufacturing, aviation, and maritime transport. This includes, for example, industrial activities related to refineries, steel, iron, aluminum, cement, lime, glass, ceramics, paper, acids, and basic organic chemicals.

Companies subject to the ETS must hold emission allowances to cover their greenhouse gas emissions. Consequently, a company with high-emission production processes is more exposed to the cost of CO₂ than a company that has invested in energy efficiency, electrification, or decarbonization.

In this case, ESG risk becomes an industrial cost: those who emit more may end up bearing higher costs.

ETS 2: Buildings, Road Transport, and Other Sectors

The ETS 2 is a separate system from the traditional EU ETS and covers emissions resulting from the combustion of fuels in buildings, road transport, and other sectors, including certain small-scale industrial activities not already covered by the main system.

An important point to clarify is that the parties directly subject to these obligations are not citizens or end consumers, but rather the operators further up the supply chain—that is, those who place fuels on the market.

However, even though the direct obligation falls on fuel and energy suppliers, the costs of the system may be passed on downstream to final prices—for example, the cost of fuel, heating, logistics, or certain transportation-related services.

For many companies, therefore, the ETS 2 risk will not necessarily take the form of a direct obligation to purchase and surrender allowances, but may manifest itself throughhigher energy and logistics costs.

The system has a phased rollout. Emissions monitoring and reporting began in 2025; the system will become fully operational in 2028; starting in 2028, after reporting verified emissions, regulated entities must surrender allowances corresponding to their emissions by May 31 of the following year.

CBAM: The Cost of Emissions Embedded in Imports

The CBAM, or Carbon Border Adjustment Mechanism, is the European carbon border adjustment mechanism.

Its goal is to ensure that European companies subject to strict climate policies are not at a disadvantage compared to non-EU competitors that manufacture in countries with less stringent emissions regulations.

The CBAM applies to certain categories of imported goods, including cement, iron and steel, aluminum, fertilizers, hydrogen, and electricity.

For companies that import these products or use them in their supply chain, the risk is clear: suppliers with higher emissions or less transparency regarding environmental data can lead to higher costs.

Concrete Examples of ESG Risks for Companies

To truly understand what ESG risks are, it helps to think of them in terms of real-life situations.

Here are some examples that many companies will recognize.

1. Energy-intensive company without a decarbonization plan

A company with high energy consumption, production processes that generate emissions, and no energy efficiency plan may be more vulnerable to:

• rising energy costs;
• increase in the cost of CO₂;
• increased pressure from banks and investors;
• a loss of competitiveness compared to more efficient competitors.

2. Company that imports materials subject to CBAM

A company that imports steel, aluminum, cement, fertilizers, hydrogen, or other products subject to CBAM may need to manage:

• new costs related to embedded emissions;
• requests for environmental data from suppliers;
• greater administrative complexity;
• the need to select suppliers that are more transparent or produce fewer emissions.

3. Facility exposed to extreme weather events

A company with production facilities or warehouses in areas prone to flooding, landslides, fires, or heat waves may be subject to:

• physical damage to assets;
• production stoppages;
• logistical disruptions;
• increase in insurance premiums;
• difficulty in obtaining certain types of coverage.

4. Suppliers Who Receive ESG Requests from Large Clients

A company that is part of the supply chain of large corporations may receive ESG questionnaires, EcoVadis requests, CDP requests, or inquiries regarding emissions, human rights, safety, governance, and climate risks.

In this case, ESG risk can become a business risk:

• loss of points on the vendor lists;
• exclusion from new bids or contracts;
• reduced appeal as a supplier;
• greater competitive pressure.

5. Environmental communication not supported by solid data

A company that reports unverifiable environmental results or makes generic claims about sustainability may be at risk of:

• allegations of greenwashing;
• loss of client trust;
• objections raised by the authorities;
• reputational damage;
• difficulties in dealing with investors and stakeholders.

6. Unmanned supply chain

A company that does not adequately monitor its suppliers and subcontractors may be exposed to risks related to:

• human rights violations;
• child labor or forced labor;
• unsafe working conditions;
• environmental non-compliance;
• reputational risks throughout the supply chain.

In all these cases, ESG risk is not merely abstract. It can translate into a cost, a lost opportunity, a deterioration in credit terms, or a loss of competitiveness.

When is it mandatory or required to assess ESG risks?

Companies may find themselves assessing ESG risks for a variety of reasons.

In some cases, there is a direct legal requirement. In other cases, the request comes from banks, investors, clients, funds, insurance companies, or public tenders.

Let’s take a look at the main areas where ESG risk assessment becomes relevant.

CSRD, ESRS, and ESG Risks

The Sustainability Reporting Directive has significantly strengthened the role of ESG risks in sustainability reporting.

Companies subject to these regulations must report information regarding the impacts, risks, and opportunities associated with sustainability issues. This means that sustainability reports are no longer limited to describing environmental or social initiatives, but must also explain how ESG issues can affect the company and its business model.

Even as part of the effort to simplify the ESRS, the assessment of risks and opportunities remains central.

This does not mean, however, that ESG risk analysis applies only to companies subject to the CSRD. Even smaller companies may receive indirect requests from clients subject to the regulation, especially when they are part of their supply chain.

SFDR and Sustainability Risk

The SFDR primarily affects the financial sector, but it is also important for businesses because it helps increase the demand for ESG data from funds and investors.

The SFDR was established as a transparency regulation for financial products that incorporate environmental and social characteristics or objectives. In practice, financial managers must provide information on how sustainability risks are integrated into financial products and how those products perform in terms of sustainability.

This has an indirect effect on the companies in which the funds hold stakes or that they evaluate.

In order to properly classify and describe their financial products, investors need reliable information from the companies in which they invest. This information may also include data on climate risks, emissions, transition plans, governance, and environmental and social impacts.

For a company, therefore, the SFDR is not normally a direct requirement, but it can become a source of ESG-related requests from funds, investors, or financial institutions.

EU Taxonomy

The EU Taxonomy is another tool that links sustainability and finance.

Its goal is to define which economic activities can be considered environmentally sustainable, based on specific technical criteria.

To demonstrate alignment with the EU Taxonomy, companies must evaluate several aspects, including:

• a substantial contribution to one or more environmental objectives;
• compliance with the DNSH principle, that is, not causing significant harm to other environmental objectives;
• compliance with minimum social safeguards.

Although the Taxonomy does not constitute a comprehensive ESG risk assessment, it still requires companies to analyze environmental, social, and governance factors that may impact the company’s financial viability, credibility, and attractiveness to investors and stakeholders.

EBA, ECB, and ESG Risks in Banks

The banking sector is one of the key areas where ESG risks are becoming increasingly significant.

In recent years, authorities such as the EBA and the ECB have introduced increasingly specific expectations and guidelines regarding financial institutions’ management of ESG, climate, and environmental risks.

The EBA Guidelines on ESG Risk Management, effective January 11, 2026, for banks that are neither small nor complex, strengthen the integration of these risks into governance systems, risk management processes, and bank assessments.

For businesses, this step is very important.

If banks are required to identify, measure, and manage the ESG risks in their portfolios, it stands to reason that they will also begin to ask their corporate clients for more information.

This information may include, for example:

• greenhouse gas emissions;
• exposure to physical and transition climate risks;
• dependence on fossil fuels;
• decarbonization plans;
• climate and financial resilience of the business model;
• the existence of climate adaptation strategies;
• quality of ESG governance.

In May 2026, the ECB published an update to its best practices on climate- and natural-risk management and stress testing, with the aim of helping banks strengthen their risk management systems.

This means that the issue of ESG risks is not limited to the financial sector. It is gradually extending to businesses as well, through requests for data and information from financial institutions.

Looking ahead, a company that is highly exposed to climate risks, lacks reliable environmental data, or does not have a credible transition plan could be perceived as riskier, even from a financial standpoint.

CSDDD and ESG Risks Along the Value Chain

The Corporate Sustainability Due Diligence Directive introduces a due diligence framework based on the identification and management of adverse impacts on the environment and human rights arising from the activities of the company, its subsidiaries, and throughout the value chain.

Here, too, the issue of ESG risks takes center stage.

Companies must be able to identify, prevent, mitigate, and manage actual or potential negative impacts. This approach primarily applies to large companies that are directly subject to the regulations, but it may also indirectly affect smaller companies that operate as suppliers.

For example, an SME might receive requests for data, policies, procedures, or ESG information from a large client that needs to monitor its value chain.

NRRP, Public Calls for Proposals, DNSH, and climate proofing

ESG risks can also play an important role in public tenders and funded projects.

In several cases, compliance with the DNSH principle—that is, the principle of not causing significant harm to environmental objectives—is required. In other cases, climate proofing or an evaluation of the project’s compatibility with climate risks may be required.

This is particularly relevant for infrastructure, public works, productive investments, and projects funded with public resources.

In these contexts, assessing climate risks is not merely a technical exercise; it can become a prerequisite for accessing financing, demonstrating a project’s compliance, or enhancing the quality of the documentation submitted.

Why should a company assess ESG risks even if it isn’t required to?

More and more companies are finding themselves having to assess and report on their ESG risks because of demands from the market or their stakeholders.

Access to Credit

Banks are gradually incorporating ESG risks into their assessments.

This does not mean that every loan is already contingent on a thorough ESG analysis, but the direction is clear: financial institutions need to better understand their clients’ exposure to climate, environmental, and transition risks.

A company might therefore receive requests regarding:

• emissions;
• energy consumption;
• climate risks;
• dependence on critical raw materials;
• transition plan;
• decarbonization strategies;
• ESG governance.

Investment Funds and Investors

Investment funds and investors are also increasingly requesting information on ESG risks.

The reason is simple: an ESG risk can affect the future value of the investment.

A company with high exposure to physical climate risks, lacking decarbonization plans, dependent on critical suppliers, or vulnerable to regulatory risks may be considered less resilient in the medium to long term.

In some projects Ollum has worked on, the request to assess ESG or climate risks came directly from investment funds interested in understanding how these factors might affect the company’s future resilience, insurance coverage, or the value of the investment.

M&A Transactions and Due Diligence

In mergers, acquisitions, or investments by new investors, ESG due diligence is becoming increasingly common.

The goal is to identify any risks that could affect the value of the company or the transaction.

These may include:

• environmental liabilities;
• non-compliance with regulations;
• exposure to climate risks;
• critical issues in security management;
• supply chain issues;
• shortcomings in governance systems;
• reputational risks.

A significant ESG risk can affect the company’s valuation, trigger requests for guarantees, or alter the terms of the transaction.

Insurance Companies

Insurance companies are paying increasing attention to climate and environmental risks.

This applies especially to companies with facilities, warehouses, or infrastructure that are exposed to:

• floods;
• fires;
• extreme weather events;
• landslides;
• industrial environmental risks.

In some cases, the risk assessment may affect premiums, deductibles, contract terms, or the availability of certain types of coverage.

A company that understands its risk exposure and demonstrates that it has implemented preventive and adaptive measures can present itself in a more credible light, even in its dealings with insurance companies.

Major Clients and the Supply Chain

For many small and medium-sized businesses, the most tangible boost comes from their clients.

Large companies and international corporations are increasingly asking their suppliers to complete ESG questionnaires, obtain ratings such as EcoVadis, or provide data on emissions, governance, human rights, safety, and environmental management.

An unprepared supplier may be less competitive, lose points on vendor lists, or be excluded from new business opportunities.

Public Solicitations and Funding

Public tenders, subsidized loans, and infrastructure projects may also require assessments related to ESG risks.

In some cases, these involve climate proofing. In other cases, they involve compliance with the DNSH principle, environmental incentive criteria, or requests for documentation regarding the project’s sustainability.

For companies that participate in competitive bidding or access public funds, the ability to assess and document environmental and climate risks can become a competitive advantage.

How to Assess and Manage ESG Risks

ESG risk management should follow a structured approach.

It’s not enough to simply fill out a questionnaire or collect some environmental data. The goal is to understand which risks are truly significant for the company and how they can be monitored and reduced over time.

An effective process may involve several steps.

1. Map activities, locations, and the value chain

The first step is to understand where the company operates, what activities it carries out, what resources it uses, and which suppliers it relies on.

This phase is important because ESG risks vary significantly depending on the industry, geographic location, production processes, and supply chain structure.

An energy-intensive manufacturing company will face different risks than a service company. A business with facilities in flood-prone areas will have different exposure than a company operating in less vulnerable areas. A manufacturer that relies on suppliers outside the EU may be more exposed to supply chain, CBAM, or traceability risks.

2. Identify ESG risk factors

The second step involves identifying the key ESG risk factors.

These may include:

• environment;
• climate;
• energy;
• raw materials;
• waste;
• health and safety;
• human rights;
• supply chain;
• governance;
• compliance;
• reputation.

At this stage, it is important not to limit yourself to a generic list, but to understand which factors are truly relevant to the company.

3. Translating ESG issues into concrete risk events

A common mistake is to focus on very broad topics, such as “climate change” or “supply chain.” To manage a risk, however, you need to break it down into specific events. For example:

• not “climate,” but “flooding of the production facility”;
• not “energy,” but “rising costs of electricity and gas”;
• not “supply chain,” but “disruption in the supply of a critical raw material”;
• not “governance,” but “a lack of oversight over the ESG disclosures published by the company.”

This step makes the analysis much more useful to management.

4. Assess Probability and Impact

Once the risks have been identified, they must be assessed.

Generally, at least two dimensions are considered:

• the probability that the risk will occur;
• potential impact on the company.

The impact can be economic, operational, reputational, regulatory, or financial.

For example, an extreme weather event can cause damage to assets and disrupt production. New environmental regulations can increase compliance costs. An accusation of greenwashing can damage a company’s reputation and erode client trust.

5. Set priorities

Not all risks are equally important.

An effective assessment makes it possible to distinguish between high-priority risks and secondary risks.

This allows the company to focus its resources, investments, and mitigation efforts on the most significant risks, rather than wasting energy on minor issues.

6. Identify mitigation measures

For each significant risk, the company should identify possible mitigation measures.

These actions may include:

• technology investments;
• energy efficiency;
• diversification of suppliers;
• improved governance;
• more structured data collection;
• internal policies;
• training;
• monitoring of climate risks;
• supply chain audit;
• decarbonization plans.

7. Monitor Risks Over Time

ESG risks are not static.

They change over time in response to regulations, weather conditions, market demands, technological advancements, and corporate strategies.

For this reason, ESG risk assessments should be updated periodically and integrated into the company’s decision-making processes.

How to Mitigate ESG Risks

ESG risks cannot be completely eliminated, but they can be managed and mitigated.

Mitigation depends on the type of risk.

Mitigating Climate and Environmental Risks

To reduce climate and environmental risks, companies can take a number of actions:

• Climate Risk Assessment for physical and transition risks;
• carbon footprint calculation;
• decarbonization plan;
• energy efficiency measures and energy audits;
• purchase or self-generation of renewable energy;
• improved water resource management;
• integration of the circular economy;
• waste reduction;
• adaptation plans for sites exposed to climate risks.

These actions can reduce exposure to ETS, CBAM, rising energy costs, physical risks, and demands from banks or investors.

Mitigating Social Risks

To reduce social risks, companies can focus on:

• occupational health and safety;
• employee training;
• procedures for managing workplace injuries;
• diversity and inclusion policy;
• supplier verification;
• supply chain audit;
• codes of conduct;
• signaling systems;
• monitoring human rights in the value chain.

These activities are particularly important for companies operating within complex or international supply chains.

Mitigating Governance Risks

To reduce governance risks, the company can take action on the following:

• a clear definition of roles and responsibilities;
• anti-corruption procedures;
• internal controls;
• compliance management;
• verification of externally disclosed ESG data;
• management training;
• protests against greenwashing;
• cybersecurity systems;
• Integration of ESG issues into corporate governance.

Strong governance is also essential for ensuring the credibility of environmental and social strategies.

What is the connection between ESG risks and financial performance?

The link between ESG risks and financial performance is becoming increasingly clear.

A company that fails to manage these risks may suffer:

• increase in operating costs;
• higher energy costs;
• higher insurance costs;
• difficulty accessing credit;
• loss of clients;
• exclusion from bids or supply chains;
• penalties;
• reputational damage;
• less appeal to investors and funds;
• impairment of assets.

On the contrary, a company that assesses and manages ESG risks can strengthen its resilience, improve its dialogue with banks and investors, better respond to client demands, and plan future investments with greater insight.

This is the true link between sustainability and finance: ESG risks are business risks that can affect a company’s ability to generate value over time.

How can we support you?

ESG risks—environmental, social, and governance—are now factors that have a tangible impact on costs, access to credit, relationships with clients and investors, and competitiveness. Assessing them in a structured manner is beneficial both for companies subject to regulatory requirements and for those receiving requests from banks, funds, clients, or public tenders.

Ollum supports companies in conducting Climate Risk Assessments for physical and transition risks, developing a structured sustainability plan, and preparing sustainability reports—even for companies addressing these issues for the first time.

Sources

ECB – Best Practices for Climate and Nature Risk Management