Before You Begin
Companies have different approaches to identifying and assessing business risks. ESG/sustainability staff should meet with the risk management department to get an understanding of various frameworks, resources and criteria they use. That information plays a critical role in using this methodology and in ensuring internal acceptance of its results. This Guidebook breaks down relevant inputs from risk management in each step of this process.
Predicting risks is a combination of art and science, and the process is typically based on the concept of reasonable assurance for the identification and consequences of risks. One well-known benchmark in defining “reasonable assurance” is the Committee of Sponsoring Organizations (“COSO”) Enterprise Risk Management Framework. COSO discusses “reasonable assurance” as reflecting the notion that uncertainty and risk relate to the future, which no one can predict with certainty.
Limitations also result from the realities that:
- Human judgment can be faulty;
- Data can be wrong, misleading or incomplete;
- Breakdowns can occur because of human failures such as simple errors or mistakes;
- Controls can be circumvented by collusion of two or more people;
- Decisions on risk responses and establishing controls need to consider the relative costs and benefits; and
- Management has the ability to override enterprise risk management decisions.
These limitations preclude anyone from having absolute assurance that objectives will be achieved. It is important to maintain this perspective throughout the exercise — you should not expect to achieve perfection or absolute confidence. At the same time, the more rigor and standardization you apply in the process, the better and more defensible the results.