Most ESG risk management is a register reviewed once a year. Sopact reads every ESG document on arrival and flags the risk the day it appears.
ESG risk management is the practice of surfacing environmental, social, and governance risk from first-party evidence — the responses workers, communities, and investees actually give — and tracing every risk flag back to the response it came from. Sopact reads that evidence on the Evidence Thread, so an ESG risk sits on a stable record next to the words that raised it, rather than being scored from an outside estimate.
Watch · 2 min
Portfolio reporting from every source
Every source in, every investor's report out. CRM, diligence, investee surveys, documents and email — one connected record, personalized reporting per recipient.
Most ESG risk work runs on proxies: an industry average, a third-party rating, a screen built from public filings. Those tell you what firms like yours tend to look like. They do not tell you what your own workers reported last quarter, or which investee’s community flagged a grievance, because that evidence was never collected on a record anyone reads. The risk that matters most is usually the one your own stakeholders already named.
Key takeaways
Sopact keeps the risk definition, investee or supplier evidence, source documents, severity, owner, action, and later status on one governed record. Portfolio teams can see current exposure while opening any risk signal back to the evidence beneath it.
An ESG rating is an outside estimate. It reads filings, news, and disclosures and places a firm against its peers. That is useful for a first screen, but it is a picture of the category, and it lags reality by however long it takes news to surface. The social and governance risks that hurt — a safety issue on a site, a grievance in a supply chain, a governance lapse at an investee — are usually known to the people closest to them long before they reach a rating.
The fix is architectural. Those people can be asked directly, and their responses can land on a record that is review evidence as it arrives. Sopact keeps ESG risk connected to that evidence on the Evidence Thread, where every flag resolves to the stakeholder response behind it, so a risk read is grounded in what was reported rather than in what the category tends to look like. Portfolio-level roll-ups build on the same records through ESG portfolio management and portfolio intelligence.
An ESG risk is credible when it points to a source. A governance flag should resolve to the survey answer, grievance, or document that raised it; a social flag should resolve to the worker or community response behind it. Without that trace, an ESG risk register is a list of assertions that no reviewer can check, and the first hard question about any line item stalls it.
Sopact is evidence-centric: a risk figure is a query that resolves to the responses on a stable record, so a diligence team or an investment committee can follow any flag back to the stakeholder who raised it. That is what connects an ESG risk view to the underlying measurement practice on impact measurement and to the investee monitoring on portfolio monitoring software.
Teams usually assemble ESG risk from three layers: a third-party rating or screen for the outside view, a spreadsheet register to log issues, and a Tableau, Power BI, or Excel dashboard to present the roll-up. Each layer does its job — the rating benchmarks, the register lists, the dashboard charts. What none of them does at the category level is keep each risk flag attached to the first-party stakeholder response that raised it, so the number on the dashboard and the evidence for it live in separate systems that never rejoin.
a practical buying check that separates a scored register from a defensible read: pick any ESG risk flag and ask the system to show the stakeholder response behind it. A rating returns a peer percentile; a dashboard returns a colored cell. Sopact answers from the Evidence Thread, because the flag resolves to the worker, community, or investee response that raised it.
Move it by collecting stakeholder evidence on a stable record, reading each response on arrival, and tracing every risk flag back to the response behind it. The table sets an externally scored register against a first-party read on the Evidence Thread.
| The question | External ESG score | Evidence Thread |
|---|---|---|
| Where does the risk come from? | Public proxies and ratings | Your own stakeholders |
| Traces to a response? | No, it is an estimate | Yes, to the record |
| When is it read? | When news surfaces | On arrival, mid-period |
| Is it a filing tool? | Sometimes claimed | No, evidence for one |
See portfolio-level risk on ESG portfolio management and the investee record on portfolio monitoring software.
An annual impact report is a lagging artifact: it summarizes a year that is already over, and its figures are assembled from data nobody read while there was still time to change anything. The value of impact evidence is highest while a program is running, when a weak result can still be improved. That is the premise of the Loop, Sopact’s method for continuous intelligence: collect clean at the source, analyze the moment data arrives, improve while there is still time to act.
The Loop is also what makes an impact claim defensible: every figure in a report traces back to the participant response it came from, the standard detailed in Loop traceability, so a funder or an investor can follow any number to its source rather than taking it on trust.
One method, three moves that never stop
Then the cycle runs again, a little sharper each time. Read the method: the Loop methodology →
Use one real ESG risk with first-party stakeholder evidence, several holdings or sites, documents, conflicting signals, an owner, response, remediation update, and a committee view.
Risk and ESG teams should update risk definitions, evidence rules, review status, response owners, and escalation thresholds without rebuilding a register.
How to test it
Signals, stakeholders, documents, incidents, holdings, controls, responses, and remediation should stay on the correct risk record.
How to test it
The workflow should handle all relevant reports, surveys, incidents, files, and updates at the required cadence.
How to test it
The team should see when a risk emerged, changed, was reviewed, received a response, and was remediated.
How to test it
Stakeholder voice should explain severity and lived experience while contradictory evidence remains visible.
How to test it
Policies, audits, incident reports, plans, and assurance documents should retain source and permissions.
How to test it
An assistant may prepare cited signals and missing-evidence checks but should not determine legal status, materiality, assurance, or remediation.
How to test it
A reviewer should reproduce one risk flag, response decision, and remediation status.
How to test it
Choose one material risk raised by an investee, partner, worker, or community member. The workflow should preserve the source evidence, applicable definition, owner, response, and follow-up instead of reducing the issue to an external score.
| Check | What must hold up |
|---|---|
| Source evidence | Can an authorized reviewer inspect this directly without reconstructing it from separate files or memory? |
| Materiality rule | Can an authorized reviewer inspect this directly without reconstructing it from separate files or memory? |
| Response owner | Can an authorized reviewer inspect this directly without reconstructing it from separate files or memory? |
| Follow-up | Can an authorized reviewer inspect this directly without reconstructing it from separate files or memory? |
ESG risk management is the practice of surfacing environmental, social, and governance risk and deciding how to respond to it. Sopact reads that risk from first-party stakeholder evidence on the Evidence Thread, so each risk flag traces back to the worker, community, or investee response behind it rather than to an external estimate.
An ESG rating is an outside estimate built from public proxies and benchmarks a firm against peers. Sopact does not rate; it reads your own stakeholders’ responses on the Evidence Thread, so an ESG risk reflects what your workers or communities actually reported rather than what the category tends to look like.
No. Sopact does not produce a CSRD, SASB, or GRI disclosure and does not sign an assurance opinion. Sopact makes the underlying first-party evidence readable and traceable on the Evidence Thread, so a filing or an audit rests on stakeholder responses that can be checked.
Every ESG risk flag in Sopact resolves to the stakeholder response that raised it on the Evidence Thread, so a diligence team can follow any flag back to its source. A risk backed by a quotable response survives scrutiny that a scored register cannot.
Yes. Because each investee is read on its own stable record, Sopact rolls risk up across a portfolio while keeping every flag tied to its evidence, the same records used for ESG portfolio management and portfolio monitoring software.
It comes from the people closest to the risk: workers, communities, grievance channels, and investees, collected clean at the source on a stable record. Sopact reads each response on arrival on the Evidence Thread, so a social or governance signal surfaces as it is reported.
Continuously, not once a year. Sopact reads each response as it arrives through the Loop methodology, so an emerging ESG risk surfaces mid-period while there is still time to act, rather than in an annual report.
No. Sopact gives the register a spine: each line item traces to the stakeholder response behind it on the Evidence Thread, so the register becomes a set of claims a reviewer can check rather than a list of assertions.
Next: roll risk up on ESG portfolio management, start at portfolio intelligence, monitor investees on portfolio monitoring software, or report it on social impact report.
