Disclosure focus
This disclosure asks an organisation to explain how it identifies, assesses and manages sustainability-related risks in practice. The focus is on the organisation’s actual risk management approach: what processes it uses, who is involved, how often risks are reviewed, and how sustainability-related risks are considered alongside other business risks.
In practical terms, the report should show whether this approach applies across the whole organisation or only to selected parts such as major sites, business units or flagship operations. Readers should be able to see the breadth of coverage, the level of integration into existing risk processes, and any important gaps or limitations in how risks are managed.
This LRA educational guidance supports disclosure preparation. For the exact requirements, always refer to the official IFRS source.
Before you start
A quick mental checklist before you prepare this disclosure — tick each as you settle it.
Preparation
Key datapoints to prepare
＋ Show s1-43 sub-elements (LRA working checklist)
Show how the information lets users judge the organisation’s overall risk picture.
Explain how the disclosure is linked into the organisation’s wider risk management process.
Set out the process clearly enough for users to understand how it works.
How to prepare it
1Set the reporting boundary first. Decide which risks, controls and business areas are in scope so the disclosure covers the full risk picture users need to understand.
2Agree what counts as the relevant risk process. Map how your risk management sits alongside the wider enterprise risk framework, and make sure the description reflects that link clearly.
3Gather support for each point you plan to report. Pull together the papers, logs, approvals, meeting records or other records that show how the process works in practice.
4Prepare the final wording or figures from the evidence. Present the information in a way that lets a reader see the overall risk profile, the connection to the risk framework, and how the process operates.
5Record any exclusions, assumptions or changes in method. Explain what was left out, what changed from the prior period, and why the approach used this period is the right one.
6Check the draft against the official source before sign-off. Confirm the disclosure still matches the source requirement, the evidence supports it, and nothing important has been missed or overstated.
Request the data
Request the risk process evidence from ERM
Translate the disclosure into an internal business question — then adapt it to your organisation's own language.
How do we show that our risk process lets readers understand the group’s overall risk picture, how it links into the wider risk framework, and how the process itself works in practice?
Use your organisation’s own risk language first, then map it to the reporting request. For example, if you talk about risk registers, control reviews, issue logs, or board risk packs internally, use those terms in the request and only translate them later for reporting. Keep the ask practical and evidence-led; check the source disclosure before sign-off.
Weak request
Please provide the disclosure wording for risk management and confirm compliance with the objective.
Why it fails: This is too close to reporting language and does not tell the owner what evidence to pull. It asks for a statement rather than the underlying material, so it is harder to verify, harder to trace to source documents, and more likely to produce a generic narrative instead of usable evidence.
Better request
Please send the current risk register summary, board or committee risk paper, and any process note that shows how risks are reviewed, rolled up, and escalated for [period] and [scope]. Include the source file, owner, date, and any recent changes. I’ll translate your internal terms into the reporting draft after review.
Industry examples
Draft your disclosure
Notes that turn data into a disclosure
LRA training templates — adapt them to your organisation, and check the official source before sign-off.
Method note
Explain the basis used to judge risk exposure, how the organisation defines its risk categories, and how the reporting process links those judgments to wider risk management arrangements.
Context note
Set out what the figures say about the organisation’s overall exposure, how closely risk work is connected to day-to-day management, and how open the process is to readers.
Fluctuation statement
If the numbers move, point to changes in the underlying risk picture, shifts in how risk is built into management routines, or differences in how fully the process is described.
Content index entry
s1-43 Risk management disclosure objective — [location / page] / [notes]
Download Centre
Preparation tools & forms
Professional preparation tools for s1-43 — free with an LRA Community membership. Register once (it's free) and every download unlocks, together with the Disclosure Library, templates and the LRA AI-assistant.
Free · Community members
Assurance readiness
For each claim, check the evidence
Evidence pack to prepare
Common reporting gaps
The information is presented without a date or as-at point.The scope or boundary of the statement is left undefined.Key terms are used inconsistently across the report.Material changes since the previous period are not disclosed.Assertions are made without supporting detail or a source record.Boilerplate is used that does not actually answer what is asked.
Common gaps
Mistakes to avoid when collecting the data
Wrong owner
The request goes to the wrong team, so the people who actually run risk reviews never see the data call and the answer comes back incomplete.
Framework language only
The data request is written in reporting jargon instead of the organisation’s own terms, so business teams cannot tell which process or record is being asked for.
No boundary set
The collector never defines which entities, functions, or risk activities are in scope, so different teams send data from different populations.
Wrong time basis
The team pulls figures from a different reporting period or cut-off date, so the evidence does not match the period being described.
Mixed counting basis
One extract uses headcount while another uses cases, reviews, or events, so the numbers cannot be compared on the same basis.
Source labels lost
Original system names, file names, or field labels are stripped out during collation, so the trail back to the source record is no longer clear.
Separate groups merged
Data for distinct risk populations is combined into one file, so differences between them are hidden and the final view is misleading.
Missing evidence trail
The pack is assembled without notes on where each item came from, who checked it, or when it was approved, so the support for the data cannot be traced.
Where judgement is often needed
Acquisition or disposal during the reporting period
Decide whether to describe the risk picture using the business mix at period end or the mix that existed for most of the year, and explain any change in scope so readers can still follow the overall exposure.
Different local risk labels for the same issue
Where country teams use different names or categories for similar risks, map them to one group in a way that lets readers compare the whole portfolio, and say how the mapping was done.
Borderline items near the reporting perimeter
For risks that sit just inside or just outside the chosen scope, set out the rule used to include or exclude them and note any material borderline cases that were left out.
Choosing the timing basis for the narrative
If the risk view changes materially between an average view, a year-end view, or another cut-off, pick one basis, use it consistently, and explain why that timing best supports understanding.
Using estimates where direct measurement is not available
When the risk description relies on judgement or proxy data rather than direct measurement, say what was estimated, what source was used, and how that affects confidence in the picture.
Rounding and aggregation of sensitive risk data
If figures or descriptions are rounded or grouped to protect confidentiality, keep the presentation consistent, make sure the totals still make sense, and explain the level of aggregation used.
Linking the risk process to the wider control framework
If risk work sits partly inside a broader control or assurance process, describe the practical link in plain language and show how that helps readers understand the organisation’s overall risk handling.
Separating process description from outcome commentary
Where the same material could be read as either a description of how the risk process works or a comment on the risk result, make clear which it is and avoid blending the two in a way that obscures the process.
Examples
Illustrative examples
Synthetic, written by LRA — not from a company report, not text from any standard.
Illustrative (synthetic) example — Manufacturing
We explain how our risk view is built so readers can judge the main exposures facing the group, and we show how that view is linked into our wider risk process rather than sitting apart from it. - Our quarterly risk review covers 18 principal risk areas; 5 are rated high, 9 medium and 4 low, giving a simple picture of where pressure is concentrated. - The same risk map feeds the enterprise risk register, with 18 of 18 principal risks assigned an owner, control actions and review dates. - We describe the steps used to prepare the assessment: business-unit inputs, central challenge by risk specialists, and final sign-off by the executive risk forum.
This synthetic example shows a plain-language narrative that helps a reader understand the overall risk picture, how it connects to the wider risk system, and the steps used to produce it.
Illustrative (synthetic) example — Retail
We set out the main threats and uncertainties in a way that lets users see the group’s overall exposure, and we explain how those matters are folded into our company-wide risk process. - Our latest review identifies 12 key risk themes; 3 are judged high, 6 medium and 3 low, so the balance of concern is visible at a glance. - All 12 themes are carried into the central risk log, and 12 of 12 have an assigned control owner and a scheduled review point. - We outline the method used to reach the view: store and online teams submit evidence, risk leads test it, and the board risk committee receives the final summary for challenge.
This synthetic example uses a different sector and wording, but still shows the overall exposure picture, the link to the wider risk process, and enough process detail for a reader to follow how the disclosure was prepared.
How companies report s1-43
Real reports where this topic is disclosed. These are report practice, not exact disclosure templates to copy.
SITC International Holdings Company Limited
Water Transportation · Hong Kong · 2025
SITC International Holdings Company Limited’s 2025 Environmental, Social and Governance Report provides evidence that users can assess the entity’s overall risk profile and its overall risk management process (p.190). The report also includes information on the processes, controls, and procedures used to monitor, manage, and oversee climate-related risks and opportunities, indicating process transparency (p.192). However, the integration of climate-related risks and opportunities with the enterprise risk management system is mentioned in related context but not clearly disclosed (p.190).
Enel Chile S.A.
Electric Utilities / IPP / Energy Traders · Chile · 2025
Enel Chile’s 2025 Integrated Annual Report provides some context on risk management, noting efforts to assess the suitability of the Internal Control and Risk Management System (ICMS) (p.168) and enabling senior management to have an integrated view of main risk exposures at a global level (p.139). The report also references ongoing processes to maintain effective internal control and execute risk control procedures daily (p.142). However, it is unclear how transparent these processes are (p.122), and there is no clear disclosure on integration with enterprise risk management overall.
✓ LRA AI Assistant · Human-in-the-loop
Ask Study Studio AI assistant about this disclosure
Get practical answers for your reporting context. Your first two answers are free — join LRA Community for free to continue without a limit.
TryHow do I prepare s1-43?What data do I need to collect?Where can I see a real-report example?What mistakes should I avoid?
2 free answers
Check your understanding
Scenarios to work through
A preparer is drafting the climate and wider sustainability risk section. The draft explains that the risk team scores issues, but it does not yet show how those scores help a reader understand the organisation’s overall exposure.
QShould the write-up make clear how the process helps users judge the organisation’s overall risk picture, rather than only listing the steps used?
Reveal model answer →Hide answer ↑Yes. The disclosure should connect the process to the reader’s ability to understand the organisation’s overall risk picture. A step-by-step description on its own is not enough if it does not show how the process supports that judgement.
Why this matters · Explain the link between the risk process and the reader’s view of the organisation’s overall exposure.
The risk register is maintained by the central risk function, while sustainability risks are also discussed in the same forum as other business risks. The draft mentions the sustainability team separately, but it does not say how this sits within the wider risk framework.
QShould the narrative show how sustainability-related risk work fits into the organisation’s broader risk management set-up?
Reveal model answer →Hide answer ↑Yes. The reader needs to see how the sustainability-related process sits within the wider risk framework, not as a stand-alone exercise. If the organisation uses the same framework, the disclosure should say so in plain language and show the connection.
Why this matters · Show where sustainability risk work sits inside the wider risk framework.
A company has a detailed internal workflow for identifying and reviewing risks, but the draft only says that risks are “managed through established controls.” It does not explain the main stages, who is involved, or how the process operates in practice.
QShould the disclosure give enough detail for a reader to understand how the process works, rather than leaving it at a high-level label?
Reveal model answer →Hide answer ↑Yes. The write-up should be transparent about the process in practical terms, so a reader can understand how it operates. A vague label does not give enough insight into the way risks are identified, assessed, reviewed, and escalated.
Why this matters · Describe the process clearly enough for a reader to follow how it works.
The draft says the board receives a quarterly risk summary, but it does not explain whether the same risk process is used for financial and sustainability matters, or whether the sustainability risks are handled separately. The preparer is unsure how much to say without overloading the note.
QShould the disclosure explain the relationship between sustainability risk handling and the organisation’s existing enterprise risk arrangements?
Reveal model answer →Hide answer ↑Yes. The disclosure should show how the sustainability-related process is connected with the organisation’s existing risk arrangements. If the same framework is used, say that plainly; if there are separate elements, explain the relationship so the reader can understand the set-up.
Why this matters · Make the link to the organisation’s broader risk arrangements clear.
Framework references
Related framework references
How this disclosure maps across the major reporting frameworks.
IFRS / ISSB
s1-43
within IFRS-S1: IFRS S1 - General Requirements for Disclosure of Sustainability-related Financial Information
Open official source →Related & explore
FAQ
Questions this page answers
For s1-43, what should I actually gather before I start drafting the disclosure?+−
The page says to prepare three things: an overall risk view, how risk management connects to the topic, and a clear note of the method used. Use those as the starting data set before you turn anything into narrative.
How do I use the step-by-step 'how to prepare' section for s1-43 in practice?+−
Use it as a working sequence: first collect the core datapoints, then check the assurance claims, then build the evidence pack, and only then draft the disclosure. The page is set up to help you move from raw inputs to a reviewable draft.
What does 'overall risk view' mean for the s1-43 workbook, and who should own it?+−
The page treats this as one of the key datapoints to prepare, so it should come from the person or team that can summarise the organisation’s current risk position on the topic. In practice, that is usually a sustainability, risk, or business owner who can evidence the view.
What evidence do I need to keep for s1-43 so the disclosure is assurance-ready?+−
The page includes an evidence pack with five items to support assurance readiness. Use that pack to keep the source material behind the risk view, the risk-management link, and the method clear enough for review.
What are the five assurance claims I need to check for s1-43?+−
The page says there are five assurance claims to verify, each tied to a claim, the related risk, and the evidence. Use those checks to test whether the draft is supported before it goes to review.
What are the common reporting gaps or mistakes on s1-43 that I should avoid?+−
The page flags common reporting gaps and mistakes, so it is worth using that section as a pre-submission checklist. It is especially useful for checking that the method is clear and that the disclosure is backed by evidence rather than general statements.
How can I turn the s1-43 page into a first draft quickly?+−
The draft-output section gives you visualisation ideas, narrative starters, and a content-index line. That makes it easier to move from the prepared datapoints into a structured draft without starting from a blank page.
How do I use the synthetic example disclosure on s1-43 without copying it into my report?+−
Treat the example as a pattern for structure and level of detail, not as content to reuse. The page also includes a quantitative table in the example, which can help you see how the data might be presented in a consistent way.
Where do I find the workbook and printable card for s1-43, and what are they for?+−
The Download Centre includes a Prep & Assurance workbook in .xlsx format and a printable Library Card in .pdf format. Use the workbook to organise preparation and assurance checks, and the card as a quick reference while drafting.
Can I reuse the same data for s1-43 and ESRS 2 General Disclosures?+−
The page says the closest ESRS correspondence is ESRS 2 (General Disclosures), so there is a useful cross-framework link. You can reuse data where it fits your reporting needs, but the page does not say the requirements are identical.
More questions this page can help with
s1-43 disclosure checklist for sustainability manager: what should be in the evidence pack?s1-43 how to assign ownership for the risk view and method claritys1-43 workbook download how to use the prep and assurance files1-43 draft disclosure narrative starters and content index lines1-43 common mistakes in reporting the overall risk views1-43 assurance claims evidence pack what reviewers will look fors1-43 synthetic example disclosure how to structure the tables1-43 what data points are needed for the disclosures1-43 method clarity how to describe the approach in plain languages1-43 risk management link how to evidence it in the drafts1-43 from company reports examples where the topic is discloseds1-43 ESRS 2 General Disclosures data reuse for cross framework reporting
Free · LRA Community
Get your s1-43 tools — free
Your preparation tools are free for LRA Community members and students. Register once (it's free) and your download starts right away — plus the Disclosure Library, templates and the LRA AI-assistant.
✓
You're in — your download is starting
Your file is downloading now. Your Community Cabinet — with the Disclosure Library, templates and the LRA AI-assistant — is ready too.
Open your Cabinet →