What is ESG risk management?
ESG risk management identifies, assesses and responds to environmental, social and governance issues relevant to an organization’s activities and decisions. It connects evidence, assessment, responsibilities and follow-up. It is broader than an ESG score, a stakeholder survey or an annual disclosure.
The perspective matters. One question concerns how an issue may affect the organization’s objectives or financial position. Another concerns adverse effects the organization may have on people or the environment. These questions can overlap, but should not be treated as identical.
COSO’s enterprise risk management resources include guidance on ESG-related risks. The OECD’s responsible business conduct guidance addresses identifying and responding to adverse impacts through risk-based due diligence.
This guide focuses on the practical evidence workflow: collecting appropriate information from operations, partners and stakeholders; reviewing it in context; and keeping the response connected to the issue.
Examples of environmental, social and governance risk
Scroll horizontally to see all columns →
| Area | Example question | Possible evidence | Responsible review |
|---|---|---|---|
| Environmental | Could operations create harmful discharges or face water constraints? | Measurements, inspections, technical assessments and local reports | Appropriate environmental and operational specialists |
| Social | Are workers or communities reporting unsafe conditions or barriers to raising concerns? | Protected feedback channels, incident records, inspections and engagement | Qualified safety, labor or community-relations owners |
| Governance | Are decision rights, conflicts or control failures being handled properly? | Policies, approvals, exceptions, audit findings and reports | Governance, legal, compliance and management owners |
The examples are starting points, not an exhaustive risk register. The relevant issues depend on the activity, location, relationships and people affected. Use the expertise and methods appropriate to the situation.
First-party feedback adds valuable context. It does not replace physical measurements, external research, inspections or professional assessment. Conversely, an external score may not answer a site-specific concern. Use the sources together where they address different parts of the question.
A practical process from scope to follow-up
- Set the scope. Identify the business activities, sites, partners and decisions covered.
- Gather relevant evidence. Combine existing records with targeted collection where gaps matter.
- Assess the issue. Distinguish reported concerns, confirmed findings and unresolved questions.
- Assign a response. Record the decision, owner, action and due date.
- Review what changed. Examine evidence of implementation and effectiveness, not only whether a task was marked complete.
These are operating steps for the evidence workflow. They do not replace the organization’s formal risk method or applicable professional and legal responsibilities.
Define an appropriate review cadence. A routine update may be periodic, while a potentially urgent issue needs a separate escalation route. Do not make an unattended survey or automated classifier the only route for urgent reporting.
Use each source for the question it can answer
An ESG rating is not necessarily a sector average. Ratings vary in purpose, sources and methodology. A rating may provide a useful company-level screen while still leaving questions about a particular site, period or stakeholder group unanswered.
Scroll horizontally to see all columns →
| Source | Useful contribution | Important limit |
|---|---|---|
| External ratings or research | Screening and context using a stated methodology | Coverage, timing and purpose may differ from the current operational question |
| Operational records | Documented activities, events and measurements | Completeness and definitions still need review |
| Worker or community feedback | Experience, concerns and information otherwise difficult to see | Response coverage, safety and interpretation matter |
| Inspections and assessments | Findings from a defined assessment process | Scope and date constrain what the finding supports |
| Partner documents | Policies, reported performance and supporting evidence | A written policy does not establish that the practice is followed |
Record when evidence conflicts. A positive audit summary and a serious worker concern should remain visible for appropriate review. Neither should automatically erase the other.
Trace the evidence without exposing the reporter
A source can be traceable without naming a person to every reader. An anonymous submission can have a source identifier, timestamp, permitted context and review history while preserving anonymity.
Use channels appropriate to the sensitivity of the information. Explain who will receive the report and how it will be used. Avoid collecting unnecessary identifiers or placing raw allegations and sensitive details in a broadly accessible dashboard.
Where follow-up contact is optional, keep that choice clear. Where information must be handled by a specialized grievance, safeguarding or investigation process, route it appropriately. Do not present an AI label as a finding about an individual.
A quiet channel does not establish that there are no problems. It may reflect limited awareness, access or confidence in reporting. Review the conditions for participation as well as the number of submissions.
What belongs in an evidence-backed risk record?
Scroll horizontally to see all columns →
| Field | Why it matters |
|---|---|
| Issue and scope | Identifies the risk question, affected activity, site or relationship |
| Source and period | Shows where the information came from and what time it covers |
| Evidence status | Separates a report, an assessed finding and an unresolved concern |
| Assessment basis | Records the applicable method, rationale and reviewer |
| Owner and action | Makes the response accountable |
| Follow-up and closure evidence | Shows what was checked before the status changed |
| Access and history | Protects sensitive material and preserves corrections |
Do not force all evidence into a person record. A concern may relate to a facility, supplier, investment or process. One issue may affect several entities, while several submissions may concern the same issue. Preserve those relationships without double counting.
Set a shared dictionary for fields that need portfolio comparison. Allow local details where risks and evidence differ. A single universal survey is not required to maintain a coherent review process.
A worked example: a signal is not yet a conclusion
In this fictional example, a company reviews a partner’s delivery site. An anonymous response raises a concern about access to protective equipment. A recent checklist reports that equipment was available. The two sources do not agree.
The team retains both sources, limits access to sensitive detail and assigns the concern to the appropriate safety owner. The reviewer checks the relevant period, shifts and scope, then determines the next action through the established process.
A later record says replacement equipment was delivered. That shows an action occurred. Closure requires appropriate evidence that the issue was addressed, not simply a completed delivery task or a more positive sentiment score.
The portfolio view can show an open issue awaiting review and the responsible owner. It should not publicly identify the reporter or announce a confirmed violation based solely on automated interpretation.
Review trends without mistaking reporting activity for risk prevalence
A rise in reported concerns can reflect deteriorating conditions, improved reporting access or both. A decline can reflect improvement or reduced willingness to report. Interpret the trend with context.
For example, 20 reports among 200 responses and 30 reports among 600 responses describe different reporting proportions: 10% and 5%. These are proportions of responses under the stated counting rule, not automatically the percentage of workers affected by a condition.
Check whether multiple reports concern the same event, whether the audience changed and whether categories were revised. Preserve the definition version when comparing periods.
Where AI can help—and where review remains necessary
AI-assisted analysis can help organize large volumes of text, apply team-defined categories and propose passages that need review. Connecting those passages to the correct source and context can reduce repeated searching and copying.
But a classifier can miss a concern or misinterpret ordinary language. A source citation can be accurate while the conclusion is wrong. Use tested review procedures, monitor unreviewed records and keep consequential decisions with qualified people.
The qualitative and quantitative analysis guide explains how controlled definitions and connected numeric context support repeatable analysis. Applying that workflow does not establish legal materiality, compliance or the effectiveness of remediation.
Evaluate ESG risk software through a complete review
Sopact’s relevant role is organizing stakeholder and partner evidence for collection, analysis and governed review. Test the configured workflow against your requirements. Do not assume that an existing risk platform, CRM or dashboard cannot retain source evidence.
Use a pilot with an anonymous submission, a partner document, conflicting information, a corrected record and a follow-up action. Ask the team to produce both an appropriately restricted working view and a management summary.
- Does the source stay connected to the right issue, site and period?
- Can reviewers distinguish reported concerns from assessed findings?
- Can permissions protect sensitive evidence while allowing useful reporting?
- Can the team update categories without silently changing historical trends?
- Can it reproduce the basis for an action and a status change?
- How much recurring reconciliation and report preparation remains?
Record setup, routine administration and review effort. A system can reduce manual assembly while preserving the specialist work the organization still needs.
Connect risk evidence to portfolio decisions
Continue with ESG portfolio management and the portfolio evidence course. For the broader collection-to-response process, see risk intelligence.
A management report should state the scope, reviewed findings, open questions, response owners and next review. Keep formal disclosure and assurance requirements with the appropriate reporting and professional processes.
Watch: bring portfolio evidence into context
The accompanying video explains a connected portfolio reporting approach. It does not establish that a risk has been resolved or replace a formal assessment.
Frequently asked questions
Is ESG risk management the same as an ESG rating?
No. A rating is one potential information source with its own method. Risk management includes assessing relevant evidence, assigning responses and reviewing what happened.
Must every risk flag identify a person?
No. Source traceability can preserve anonymity. A record may concern a site, organization or process, and sensitive reporter information should have appropriate protection.
Can a survey establish that a site is safe?
Survey evidence can reveal important experience and concerns. It cannot by itself establish the absence of hazards or replace appropriate safety assessment.
Does a completed action mean the risk is resolved?
Not necessarily. Review evidence of whether the action addressed the issue and record the basis for any status change.
Can AI make the final compliance or remediation decision?
AI can assist with organizing and reviewing evidence. Consequential judgments require qualified human review and the relevant organizational process.
Choose your next step
American Heart Association Ventures
See portfolio evidence in practice. This story does not establish ESG compliance or validate the fictional risk scenario.
Read the customer story →