UK SRS S1 Risk Management Disclosures: How to Integrate Sustainability into ERM

ANSWER · EXPLAIN · APPLY · EVIDENCE · CONNECT · PUBLISH

London Reporting Academy · Controlled publication draft · 3 August 2026

The risk-management pillar enables users to understand the entity’s processes for identifying, assessing, prioritising and monitoring sustainability-related risks and opportunities, whether and how those processes are integrated into overall risk management, and the entity’s overall risk profile and risk-management process. A generic statement that sustainability is embedded does not reveal inputs, criteria, ownership, relative priority, monitoring, process changes or decision use.

Integration should be visible in the operating process. Sustainability-related items should enter the same or a reconciled risk universe, use defined assessment criteria, have owners and escalation routes, inform treatment and strategic decisions, and be monitored alongside other material uncertainties. Opportunities require a process as well, although the entity may use criteria and governance appropriate to opportunity development.

Visual: Sustainability integration into the ERM loop

The loop is an implementation model. UK SRS S1 requires disclosure of identification, assessment, prioritisation, monitoring, changes and integration, but does not mandate this cycle or a particular system.

Paragraph 43 has two user outcomes. First, users should understand the process for risks and opportunities, including integration into overall risk management. Second, they should be able to assess the entity’s overall risk profile and overall risk-management process. The disclosure must therefore show how sustainability changes the total risk picture, not merely describe a specialist workshop.

The entity explains the inputs and parameters used, including data sources and the scope of operations covered. A process can appear sophisticated yet omit major subsidiaries, supplier tiers, customer uses, geographical exposures or long-term conditions. Scope should be stated clearly and significant exclusions or data limitations should be visible.

Paragraph 44 asks whether and how scenario analysis is used to inform identification of sustainability-related risks. It does not require scenario analysis for every sustainability issue. Other UK Sustainability Reporting Standards may specify when scenarios are required and how they should be prepared. The general disclosure should state the actual role of scenarios and distinguish them from forecasts or predictions.

• Identify which risks or opportunity areas use scenario analysis and why.

• Explain scenario source, horizon, key assumptions and connection to the entity’s facts.

• Describe how results changed identification, scope, priority, treatment, strategy or monitoring.

• Explain limitations and avoid presenting a scenario as the most likely future unless that is the stated method.

• Retain scenario versions, assumptions, model governance and approval evidence.

UK SRS S1 requires disclosure of how the entity assesses the nature, likelihood and magnitude of the effects of sustainability-related risks, including whether it uses qualitative factors, quantitative thresholds or other criteria. The Standard does not prescribe a universal scale. An entity may use a 5x5 matrix, expected-loss model, qualitative categories, scenario thresholds or a hybrid, provided it explains the actual method and its relationship to overall ERM.

Velocity, duration and aggregation are useful implementation criteria when they help assess nature, likelihood and magnitude. They should be presented as part of the entity’s methodology rather than as additional UK SRS requirements.

The entity explains whether and how sustainability-related risks are prioritised relative to other risk types. A separate specialist score can be used, but the route from that score to enterprise priority should be clear. Differences in horizon, uncertainty, qualitative significance or aggregation may require reconciliation rather than a forced numerical conversion.

Paragraph 44(b) requires disclosure of processes used to identify, assess, prioritise and monitor sustainability-related opportunities. Opportunities are not simply positive risks and need not use the same scoring logic. They may enter strategic planning, innovation, product governance, investment committees or business-development processes. The report should explain the process and how it interacts with risk management and governance.

• Define what qualifies as a sustainability-related opportunity and its pathway to prospects.

• Identify sources such as customer demand, policy, technology, resource efficiency, workforce capability and financing.

• Explain criteria such as addressable market, strategic fit, investment, execution risk, time to value and uncertainty.

• Describe prioritisation, investment gates, ownership, monitoring and decisions to pause or discontinue.

• Connect opportunity pursuit to associated risks, trade-offs, financial planning, metrics and targets.

The disclosure explains how risks are monitored and whether and how the process changed compared with the previous reporting period. Monitoring can include metrics, thresholds, incidents, trend indicators, control testing, target performance, scenario triggers and external developments. It should lead to reassessment or action when thresholds are breached.

Paragraph 44(c) asks for the extent to which and how sustainability-related processes are integrated into and inform overall risk management. Integration is a matter of degree and operation. A shared system can help but is neither required nor sufficient. Separate specialist tools can support integration when criteria, governance, ownership, escalation, decisions and reporting are connected.

Visual: Evidence of actual ERM integration

The maturity ladder is an LRA implementation aid, not a UK SRS requirement. It helps reviewers distinguish unsupported language from evidence that assessment changes ownership, escalation, strategy, capital and monitoring.

For entities within scope of the UK Corporate Governance Code 2024, risk-management and internal-control processes may provide substantial evidence and infrastructure. The FRC’s related guidance is principles-based and non-mandatory. It can support implementation thinking, but it does not replace UK SRS S1 paragraph 44, and Code reporting prepared for a different objective may need additional sustainability-specific detail.

1. Map the existing ERM framework, taxonomy, risk appetite, scales, governance, systems and cycle.

2. Define sustainability-related risk and opportunity criteria and the pathway to prospects.

3. Set the reporting-entity, operations and value-chain scope and record exclusions and data limitations.

4. Create an input and trigger inventory covering internal, external and scenario information.

5. Reconcile specialist and enterprise assessment criteria, including horizons and qualitative factors.

6. Assign risk and opportunity owners and define escalation, review and decision authority.

7. Prioritise sustainability risks relative to other risks and document aggregation and judgement.

8. Integrate treatment, opportunity investment, budgets, capital, insurance and strategy where relevant.

9. Select monitoring indicators, thresholds, incident routes and reassessment triggers.

10. Record changes from the previous period and why they alter or improve the process.

11. Build an evidence register linking disclosure to methodology, assessments, committee papers and decisions.

12. Run a connected review against governance, strategy, metrics, targets, financial effects and financial statements.

The group integrates the assessment by mapping supplier locations to the enterprise taxonomy, using scenario and procurement data to assess disruption likelihood and magnitude, and comparing the result with other supply and operational risks. The chief procurement officer becomes risk owner; thresholds trigger the risk committee and capital approval for alternative sourcing. The product opportunity is assessed through the innovation committee using strategic fit, investment, demand, margin and execution risk, with progress reported to the executive risk forum.

Monitoring includes supplier financial and operational indicators, water restrictions, inventory cover, qualification milestones and product-development gates. The disclosure explains inputs, criteria, relative priority, opportunity process, treatment and changes from the previous period. It does not claim that use of the enterprise system eliminated the risk.

UK SRS S1, February 2026: paragraphs 21-24, 43-44 and supporting guidance B6-B11 and B39-B44.

FRC, UK Corporate Governance Code 2024: additional risk and control context only for entities within scope.

FRC, Guidance on the Strategic Report, February 2026: risk and linkage context; non-mandatory.

UK Government and FRC sustainability guidance: current voluntary-use status.