A flood at a supplier’s plant halts production whether or not the organisation prepares a sustainability report. The same holds for a rise in emission charges, a labour inspectorate ruling or the loss of a customer once working conditions at a subcontractor come to light. Environmental, social and governance factors affect an organisation’s objectives through channels that existed long before reporting obligations appeared and that will outlast their curtailment. One of those channels, communication about the environmental credentials of products, is now becoming a matter of enforceable law, albeit a year behind the EU timetable in Poland.
This article approaches ESG risk from the standpoint of management practice. It explains why exposures do not vanish with the reporting obligation after the Omnibus package, sets out the three categories of factors together with climate risk and greenwashing, covers the supply chain, double materiality and the link to enterprise risk management, and closes with the practical questions of identification, assessment, scenario analysis, ownership and indicators.
What is ESG risk?
ESG risk is the risk an organisation faces as a result of environmental, social and governance factors. It can affect operational activities, financial performance, legal compliance and corporate reputation. ESG factors do not constitute a separate risk category alongside operational, financial or legal risk; they describe sources of threats that can materialise across different areas of an organisation’s activities.
The letter E covers the impact of the environment on the organisation and of the organisation on the environment; S concerns relationships with employees, communities and customers; and G concerns how decisions are made and overseen. A drought raises the cost of a raw material, and the organisation records it as price risk. A collective dispute stops a production line and is entered in the risk register as an operational risk.
In both cases, an ESG factor triggers a mechanism the organisation already knows from other areas of enterprise risk management (ERM).
Why is ESG risk about more than reporting?
The Omnibus I simplification package removed around 90 per cent of the entities previously subject to sustainability reporting in Poland from that obligation, yet none of the exposures they had been reporting disappeared with it. Directive 2026/470 entered into force on 18 March 2026 and confined the reporting requirement to undertakings with more than 1,000 employees and net turnover above EUR 450 million. Small and medium-sized enterprises listed on regulated markets, which under the original Corporate Sustainability Reporting Directive (CSRD) were to report under a separate, lighter standard, dropped out of scope entirely. In Poland, the Act of 27 February 2026 (Journal of Laws 2026, item 333) allowed first-wave undertakings, those that began reporting for 2024 and now fall outside the new thresholds, to stop. Draft UC155, covering the remaining simplifications, was still in consultation in the summer of 2026. The simplified European Sustainability Reporting Standards (ESRS), adopted by the Commission on 3 July 2026 and still subject to scrutiny by Parliament and Council, will cut the number of mandatory data points by around 60 per cent while retaining the principle of double materiality.
So an organisation that spent two years building up its reporting capability now finds the obligation has shrunk and the exposures have not moved an inch. The supplier’s plant still stands on a floodplain, the energy contract still carries an indexation clause, and the customer still asks about working conditions in the supply chain, only the answers no longer need to be published in a standardised annex. What was built under compulsion – the ability to collect and analyse that data – is now an advantage over competitors who never had to build it.
What are the three main categories of ESG risk?
A leak from an installation is an environmental event. Its consequences for nearby residents are a social event, and the question of why nobody acted on earlier warning signs belongs to governance. The three-way split is a way of organising the analysis, not a description of how incidents behave; one leak can tick all three boxes. Whichever letter a factor sits under, it usually shows up in one of two forms: as regulatory risk, meaning the cost of adaptation and sanctions, or as reputational risk, meaning the loss of trust among customers and partners.
Social risks
In spring 1994 Swedish television broadcast a documentary on child labour in carpet production in Pakistan, where IKEA then sourced, and the company learned of the problem from the broadcast. A year later a German documentary maker had obtained footage from the plant of one of the company’s Indian suppliers, Rangan Exports, and refused to let the company see it before the broadcast. Out of that experience came supplier codes of conduct and partnerships with UNICEF and Save the Children, still cited as a model today. For a risk manager the interesting part is not the happy ending but the first half: the organisation was buying in a jurisdiction where the practice was widespread, and its controls showed nothing but prices and delivery dates. Social risks today cover human rights, working conditions and safety, labour rights in the supply chain, relations with local communities, diversity and responsibility towards customers, and what they have in common is that the organisation usually cannot see them.
Governance risks
Can a company damage its own reputation by enforcing rights whose non-enforcement would weaken its ability to defend that same reputation? The question sounds abstract until one looks at the dispute between Patagonia and Pattie Gonia. Pattie Gonia is the stage persona of an environmental activist whose views on conservation align with the company’s own, and yet in early 2026 Patagonia sued for trademark infringement, seeking a symbolic one dollar in damages. The immediate trigger was the activist’s application to register a mark of his own for clothing and marketing services. The company’s stated reasoning was straightforward: it cannot enforce its rights selectively according to whether it agrees with someone’s views, because inconsistency would cost it the ability to stop the fossil fuel lobby or counterfeiters.
The governance point is that both protecting the trademark and building the brand on values, are perfectly defensible decisions inside the function that took them. The legal department measures success in rights preserved, the communications department in standing with a particular audience. The damage arose at the junction of the two, which fell within nobody’s remit, and the reputational cost was incurred at the moment of filing and will be incurred again with each subsequent statement, whatever the eventual judgment. EU law likewise weakens a mark that is not consistently defended, and years of tolerating another’s mark can forfeit the right to challenge it, so the same pressure operates in Europe. Beyond this example, the category covers corruption, conflicts of interest, opaque decision-making structures and weak controls.
Environmental risks
This group covers extreme weather and its effect on assets, suppliers and logistics, the cost of emissions and energy, the availability of water and raw materials, pollution, biodiversity loss, asset impairment and liability for environmental damage. Climate risk, as the best documented part of the group, is discussed separately in the next section.
Climate risk: how do physical risks differ from transition risks?
Climate risk falls into two main categories: physical risk and transition risk. Physical risk arises from the direct effects of climate change, such as floods, droughts, wildfires, storms and heatwaves. It can lead to damage to assets, production interruptions, supply chain disruptions, and problems with the availability of employees and infrastructure.
Transition risk, by contrast, arises from changes introduced in response to climate change. It includes the effects of new regulations, climate policies, technological developments, changes in energy and emissions prices, and the expectations of customers and investors. One example is the increase in fuel and heating costs associated with the introduction of the ETS2 system.
Both types of risk can occur simultaneously, but they require different approaches to assessment and management. Physical risk calls primarily for analysis of location and infrastructure resilience, whereas transition risk requires monitoring regulatory, market and technological developments.
Insurance-industry secondary perils – wildfires, convective storms and floods, as distinct from hurricanes and earthquakes – accounted for 92 per cent of insured catastrophe losses in 2025. This means that losses are now being driven by events affecting ordinary facilities in ordinary locations.
Why is greenwashing a compliance risk and not only a reputational one?
In Poland, the process of transposing Directive 2024/825 has concluded with the adoption of the Act of 4 September 2026 amending the Act on Counteracting Unfair Market Practices and the Consumer Rights Act. The President signed it on 15 October 2026, and it was published in the Journal of Laws on 19 October 2026 (Journal of Laws 2026, item 1353). However, the Act will not enter into force until 27 September 2027, one year after the date on which the Directive’s provisions were due to start applying.
The amendment introduces, among other things, definitions of an environmental claim and a sustainability label, and expands the catalogue of practices considered unfair towards consumers. Businesses therefore have additional time to adapt their marketing communications, product labelling and procedures for verifying environmental claims.
Does the one-year postponement of the new rules mean a year of impunity? No. Although the provisions implementing Directive 2024/825 will not apply in Poland until 27 September 2027, regulations prohibiting misleading practices towards consumers are already in force. The existing Act on Counteracting Unfair Market Practices prohibits conduct that misleads consumers and influences their purchasing decisions. In January 2026, the President of the Office of Competition and Consumer Protection (UOKiK) brought charges over environmental claims against companies including Bolt, Tchibo and Zara.
These provisions concern communication aimed at consumers. In business-to-business relationships, they operate indirectly: an environmental claim made to a business customer and then repeated to that customer’s own customers exposes both companies to risk. Which is a specific example of supply chain risk.
How does ESG risk arise in the supply chain?
The claim that requirements cascade down to smaller firms through contracts with large customers remains commercially valid, though from 2027 it will run into a legal limit. The voluntary reporting standard adopted by the Commission on 3 July 2026 will define the information a large entity may demand from a supplier with up to 1,000 employees. The mechanism will apply to financial years beginning on or after 1 January 2027, provided neither Parliament nor Council objects. The limit is narrowly drawn, however: it covers data gathering for sustainability reporting and leaves untouched questions asked in the course of due diligence, risk assessment or an ordinary commercial relationship. A supplier may refuse a request that goes beyond the standard, and the customer may not make cooperation conditional on the answer.
The Corporate Sustainability Due Diligence Directive, in its post-Omnibus form, works similarly: full mapping of the chain is not required, analysis rests on reasonably available information, and detailed enquiries to partners are permitted only where necessary, taking into account whether the partner is subject to comparable rules and how strongly the law is enforced in its environment.
The question has changed. It used to be how much data could be obtained from suppliers; now it is how to decide about suppliers when the law deliberately caps what can be asked. The answer lies in standard risk methodology: concentrating on suppliers critical to the process, on jurisdictions with weak enforcement and on products where a breach would be most visible. A supplier with privileged access to the organisation’s infrastructure is a separate case, discussed under operational technology (OT) risk.
ESG risk and double materiality: what is the difference?
Risk assessment asks what the world can do to the organisation; double materiality analysis asks that question and adds the reverse: what the organisation does to people and the environment. The first direction is financial materiality, the second impact materiality. The second goes beyond traditional risk assessment because the harm arises outside the organisation’s balance sheet. A plant’s emissions burden the atmosphere while the income statement remains untouched, at least on the day they occur.
The organisation’s impact on people and the environment becomes its financial risk the moment a regulator, a court, a customer or a lender notices it. A plant that has emitted pollutants for a decade without consequence bears no cost until the day the municipality commissions measurements and the bank asks for the results at loan renewal. Impact materiality is, in other words, often just financial materiality that has not arrived yet; and how long that takes depends on who is paying attention. The double materiality principle survived the revision of the ESRS and remains mandatory for entities within reporting scope, though its analytical usefulness does not depend on that obligation.
How should ESG risks be tied into enterprise risk management (ERM)?
Environmental contamination caused by a control system taken over by an attacker is the environmental consequence of a cyber event, and it is hard to place in a separate ESG register in any coherent way. Who would own such an entry: security, maintenance or the environmental officer? An extreme example, but the rule behind it is general: ESG factors change the size of risks the organisation already has, rather than adding new species of risk.
The case against a separate ESG register is, in the end, about the quality of what reaches the board. A parallel register produces parallel prioritisation, so the board receives two risk rankings built on different scales by different teams. Third place on one list means nothing next to third place on the other, and nobody can say which of the two deserves the money.
In practice the test is whether a given factor has its own owner and its own action plan. Rising emission costs usually feed the margin risk the organisation already has in its register; finance remains the owner, and the climate factor joins the list of causes alongside commodity prices and exchange rates. The labour practices of a specific supplier in a specific jurisdiction, by contrast, call for an entry of their own: they fit none of the risks already described, and their consequence is the loss of a customer who is answerable for its own supply chain. Procurement owns it, because the response consists of an audit, a change in contract terms or a change of supplier. A governance, risk and compliance (GRC) platform that ties risks to objectives, processes, controls, suppliers and actions in a single system makes this approach possible without duplicating registers, provided ESG factors are treated within it from the outset as attributes of existing risks.
How does disinformation compound ESG risk?
In the two-year risk ranking published by the World Economic Forum in January 2026, misinformation and disinformation take second place, and they are among the few risks to appear near the top across every time horizon. The Forum describes them as a factor that catalyses other risks, and in the ESG field that works in two quite specific ways.
The first is about what goes into the assessment. Supplier declarations and certificates are often unverifiable, and photographic material from a plant, which not long ago counted as weak evidence, has ceased to be evidence at all in the face of AI-generated material. The divergence between ratings assigned to the same company by different commercial ESG rating providers is well documented, which means a register fed with such ratings inherits a dispute it cannot itself resolve. The quality of a risk assessment is bounded by the quality of the data it rests on, and in the ESG field that data rests more often on assertion than on measurement. Which is why source checking, expert verification and some training in spotting manipulation belong inside the assessment process rather than beside it.
The second mechanism is less obvious and follows from the rules discussed above. The rising legal cost of making environmental claims makes silence the rational response for a cautious legal department. The market’s knowledge of corporate environmental performance, however, is built largely from what companies say about themselves. Fewer substantiated claims yield a poorer information environment, in which unsubstantiated claims and hostile narratives take up proportionally more room. The Patagonia dispute shows this in practice: both sides argued publicly mainly about how the dispute was framed, the symbolic one dollar against the actual scope of the demands, while the legal questions receded into the background.
How should ESG risks be identified and assessed?
Identifying ESG risks works like any other risk identification: process reviews, conversations with area owners, analysis of incidents at competitors and in the supply chain. Only those matters that bear on the organisation’s business model and sector make it into the register, however; the presence of a topic in a reporting standard does not settle that on its own. The general method is covered elsewhere; what follows is only what works differently for ESG factors.
The first difference is the time horizon. A standard register assesses risk over the financial year or the audit cycle, whereas the effects of climate and transition exposure mostly fall outside that window. With a probability scale that ends at twelve months, long-term risks receive low scores, because an event beyond the scale’s range gets the same score as an improbable one. The remedy is to assess the same factor across three horizons as three separate questions: what happens this year, what happens over the strategic plan, and what happens over the useful life of the assets.
Then there is the data. Assessment of operational risk rests on the organisation’s own records: breakdowns, complaints, stoppages. Assessment of supply chain risk rests on what a supplier says about itself, and for environmental risks on models covering periods longer than any historical data the organisation holds. The practical lesson: for ESG entries, record not just the score but where it came from, because in a year’s time it will matter whether a low score reflected a measurement or a blank.
How can scenario analysis be used in managing ESG risk?
Scenarios are not a forecasting tool; they test whether a decision that is sound under today’s conditions stays sound under different but plausible ones. An organisation weighing the replacement of its delivery fleet ahead of ETS2 faces two uncertainties at once: the start date, already moved once from 2027 to 2028, and the size of the fuel price rise, which depends on the allowance price. Rather than wait for both to settle, the organisation costs fleet operation under several combinations: an early start with a high price, a later start with a moderate price, and a further postponement with no significant rise.
If replacement pays off in every combination, the decision can be taken now without waiting for the rules. If it pays off only in some, the analysis identifies the fuel price or the date at which the decision reverses, and that threshold becomes an indicator to monitor. What comes out of the exercise, then, is a threshold and the action tied to it.
Who owns ESG risk, and which KRIs apply?
ESG risk most often lands with the sustainability function, which rarely has the authority to approve the spending that would remove it. The owner should be whoever controls the decision. For the risk of supply interruption from a flood at a key supplier, procurement is the owner, because procurement can contract an alternative source. The response is qualification of a second source, the control an annual review of supplier locations against flood hazard, the evidence of the control’s operation the minutes of that review, and the indicator the share of purchases from a single source. Leave any of those out and the entry is a description of a hazard, not the management of one. Reputational risk tied to communications needs an owner at board level, because only the board has the authority to determine what position the organisation will take under pressure.
Key risk indicators (KRIs) for ESG typically include emissions and energy use, accident numbers, staff turnover, whistleblowing reports and code of ethics breaches, the share of suppliers in high-risk jurisdictions and the number of non-conformities found. The list on its own achieves nothing. An indicator begins to work only once a threshold has been agreed in advance for each item, together with what happens when it is crossed: who is notified, what decision then comes up for consideration, and by when.
External pressure as a false indicator
External pressure gets its own section because it is usually measured with the worst tool available. When criticism builds on social media, the natural reflex is to gauge its scale by the number of posts. That number says nothing about sales. There is no way of knowing how many people are behind a thousand posts, whether those authors were ever customers, or whether an announced boycott will translate into anything beyond the announcement. The record is mixed, too: Nike, after a wave of boycott calls in 2018, did not withdraw its campaign and saw no sign of the expected collapse in sales, whereas Bud Light, which gave way under similar pressure in 2023, still lost a large share of its US sales and with them its position as the best-selling beer in that market.
Add to that how the platforms themselves work: content that stirs emotion is promoted by algorithms, so visibility grows faster than the number of people actually involved, and the picture reaching the board is by its nature skewed towards exaggeration. Reading the volume of online discussion as a demand signal is a measurement error. The practical question is whether the organisation could tell an amplified wave of comments from a real fall in demand if both happened tomorrow.
The control is not complicated. Before the organisation publicly reverses a decision already taken, it should check what its own data shows: sales against the level before the event, the state of the order book, and the number of cancellations and returns. Only those figures say whether a loss has actually occurred. The reversal decision itself needs an owner at board level, not because the matter is important but because reversal is often costlier than holding the line, and a person without the authority to refuse will in practice always give way.
Examples of ESG risks in a risk register
| Category | Example of risk | Potential impact |
| Environmental | Flood in the region of a critical supplier | Supply interruption, production stoppage |
| Environmental | Rise in motor and heating fuel prices after the launch of ETS2 | Higher operating costs, lower margins |
| Environmental | Restrictions on water abstraction during drought | Production halt |
| Social | Labour rights violations at a subcontractor | Loss of a customer, sanctions, reputational cost |
| Social | Fatal workplace accident | Legal liability, work stopped by the inspectorate |
| Governance | Conflict between trademark protection and brand positioning | Reputational cost independent of the outcome of the dispute |
| Governance | Ineffective controls | Abuses and non-conformities detected late |
| Cross-cutting | Greenwashing in product communication | UOKiK fine of up to 10 per cent of turnover for each contested practice |
Summary
The figures used in a report should come from the same system as the figures used in decisions. Where reporting data is assembled in a separate exercise for publication, the organisation creates greenwashing risk inside its own reporting process, because what it declares publicly may differ from what it acts on. Keeping risk management and reporting on the same numbers is therefore an operational matter, not a disclosure one – and it applies just as much to entities the Omnibus package has released from reporting. The aim of ESG risk management remains to bring environmental, social and governance factors into the organisation’s actual decision processes, into budgeting, supplier selection, investment planning and communication, in the same way the organisation treats any other risk that bears on its objectives.
