UK SRS S2 Climate Risk Management: Identification, Prioritisation and ERM Integration

Educational practitioner guidance. Not legal or assurance advice. Verify the current UK SRS text, applicable reporting rules and entity-specific facts before acting.

The risk-management objective in UK SRS S2 is to help users understand how the entity identifies, assesses, prioritises and monitors climate-related risks and opportunities, including whether and how those activities are integrated into and inform overall risk management. A risk register is an output of that process. It does not, by itself, explain how risks entered the register, how they were evaluated, how their priority was determined, what changed during the year or how the conclusions affected enterprise decisions.

The process should also connect to the strategy disclosures. The climate matters identified under paragraphs 10-12 feed the business-model, strategy, financial-effects and resilience disclosures. Conversely, scenario analysis, asset information, investment plans and financial planning provide inputs back into risk identification and monitoring. This is why a disclosure written entirely by the sustainability team, without the risk and finance functions, often lacks the connected information users need.

Figure 1. UK SRS S2 climate risk management is a controlled loop linking climate inputs, risk and opportunity assessment, ERM decisions, monitoring, finance and governance.

A complete process begins with a structured universe of possible physical risks, transition risks and opportunities. Physical risks can be acute or chronic and should be connected to hazards, exposure and vulnerability rather than generic labels. Transition risks can arise from policy, law, technology, market demand, reputation and other changes associated with a lower-carbon economy. Opportunities can arise from efficiency, products, services, markets, financing and resilience solutions.

The universe should be tailored to the business model and value chain. A UK office-based services group, a food manufacturer, a bank and an infrastructure owner will not use the same exposure map. The process should show how internal information, sector and geographic evidence, prior events, current conditions and forecasts were screened and how the team decided which matters warranted detailed assessment.

UK SRS S2 requires disclosure of how the entity assesses the nature, likelihood and magnitude of climate-related risk effects. It does not require a universal probability scale. A useful method can combine qualitative assessment, quantitative thresholds and expert judgement, provided the criteria are defined, relevant to the time horizon and linked to decision-making.

Likelihood can be difficult to express as a single probability when pathways, policy choices and physical hazards are deeply uncertain. The entity may use bands, narratives or conditional likelihoods, but it should explain what they mean. Magnitude should not be restricted to the current-year profit effect. Depending on the risk, relevant dimensions can include revenue, costs, asset impairment, cash flows, financing, business continuity, strategic option value and concentration. The method should also prevent a low-probability but severe risk from disappearing solely because a simple score multiplies two numbers.

The disclosure should explain whether and how climate risks are prioritised relative to other risk types. This does not mean forcing every climate risk into the same numerical scale regardless of its characteristics. It means showing how the entity’s risk appetite, escalation thresholds, strategic planning and governance process allow climate matters to compete for management attention, capital and control resources on a comparable basis.

Figure 2. A defensible climate-risk and opportunity process leaves evidence at every stage, from scope and inputs to prioritisation, monitoring, ERM decisions and reporting.

Paragraph 25 separately requires information about the process used to identify, assess, prioritise and monitor climate-related opportunities, including how scenario analysis informs their identification. An opportunity process can share data and governance with risk management, but it often needs additional commercial and investment inputs. Product strategy, customer demand, technology options, financing, procurement and market-entry decisions may be more relevant than the controls used for downside risks.

The entity should avoid listing every green initiative as a climate opportunity. A decision-useful opportunity has a plausible link to prospects, an identified market or operational mechanism, a time horizon, a resource requirement, uncertainty and a monitoring measure. Where opportunity information is commercially sensitive, the disclosure still needs to meet UK SRS S1 requirements; sensitivity does not automatically permit omission.

1. Lock the scope. Confirm the reporting entity, business units, assets, geographies, value-chain reach, time horizons and interfaces with the existing ERM process.

2. Build the climate-risk and opportunity universe. Use internal and external evidence to identify relevant physical and transition drivers and commercial opportunities.

3. Define the assessment method. Document nature, likelihood, magnitude, thresholds, qualitative criteria, uncertainty treatment and the role of scenario analysis.

4. Assign owners and challenge roles. Separate business ownership, technical preparation, risk challenge, finance review and governance approval.

5. Perform the assessment. Record effect pathways, concentrations, time horizons, assumptions, existing controls and proposed responses at a level useful for decisions.

6. Prioritise and integrate. Map outcomes into ERM, risk appetite, strategic planning, investment, insurance, treasury and operating decisions.

7. Set monitoring and triggers. Define KRIs, leading indicators, trigger events, review frequencies, escalation routes and the emerging-risk watchlist.

8. Reconcile changes. Explain changes in scope, data, scenarios, thresholds, risk ratings, ownership and ERM treatment since the previous period.

9. Draft and evidence the disclosure. Link each statement to the policy, methodology, register, scenario evidence, minutes, dashboard and approval record that supports it.

The company creates a site and supplier exposure register, screens acute and chronic physical hazards, and uses transition pathways to test carbon costs, energy mix, technology and customer-demand assumptions. Risk owners assess operational disruption, capital requirements, margin pressure and supply concentration over defined time horizons. The risk function challenges the ratings against enterprise criteria, while finance reviews the transmission to costs, assets, cash flows and funding.

The company identifies a water-related physical risk at two plants, a transition risk linked to product carbon intensity and an opportunity to redesign a lower-emission product line. The physical risk is escalated into the principal-risk process because the scenario findings show a plausible combination of downtime, capex and insurance constraints. The opportunity enters the strategic investment pipeline rather than the downside risk register. Monitoring uses water-stress indicators, policy triggers, customer tender requirements and approved capex milestones.

A climate risk list is disclosed, but the process that generated it is not described.

The assessment covers operations while the report makes broad value-chain claims without explaining selection or limitations.

Scenario analysis is mentioned in the strategy section but its role in risk identification is absent.

Likelihood and magnitude scales are undefined, use inconsistent time horizons or create false numerical precision.

Climate risks are prioritised only within a climate workshop and not relative to enterprise risks.

Opportunity identification consists of listing current initiatives rather than assessing plausible effects on prospects.

Monitoring is annual, with no KRIs, trigger events or escalation between reporting dates.

Changes to scope, methodology, data sources or risk ratings are not explained.

ERM integration is described in boilerplate but cannot be traced to risk appetite, planning, capital or governance evidence.