Summary
In short
- The reporting picture changed substantially in 2025 and 2026. The EU's Omnibus I directive was adopted in February 2026 and entered into force in March, raising CSRD thresholds so that by most estimates 85 to 90 percent fewer companies fall within mandatory scope.
- The simplified ESRS submitted by EFRAG in December 2025 cut the number of data points by around 61 percent nominally, and sector-specific standards will no longer be developed.
- In the United States the SEC stopped defending its climate rule in March 2025 and proposed to rescind it in May 2026, while California's SB 253 and SB 261 proceed despite legal challenge.
- Meanwhile ISSB-aligned reporting is becoming mandatory across a widening set of jurisdictions, including Australia on a phased basis and Brazil, Mexico and Chile from 2026.
- CSRD applies double materiality, covering both how climate affects the company and how the company affects the environment. IFRS S1 and S2 address financial materiality only.
- Relief from reporting scope is not relief from the risk. Insurers and customers ask the same questions regardless of whether a directive requires an answer.
What it is
What it is
What is a climate risk assessment?
An assessment of how a changing climate affects a site: physical risks from flooding, heat, drought, storm and water stress; the operational effects those produce; and transition risks from policy, market, technology and reputational change. It sits under environmental management and increasingly feeds a reporting obligation held elsewhere in the business.
What is the difference between physical and transition risk?
Physical risk is the direct effect of climate on assets and operations, divided into acute events such as flooding and storm, and chronic shifts such as rising mean temperature or water stress. Transition risk is the effect of moving to a lower-carbon economy: carbon pricing, regulation, changing customer requirements, technology shifts and reputational exposure.
When to use it
When to use it, and when not to
This is a site-level assessment producing operational findings. It feeds corporate reporting rather than constituting it.
Use it for
- Periodic site assessment against flooding, heat, storm, drought and water stress
- Following a flood, heat event or supply interruption that revealed an exposure
- Site acquisition, expansion or major capital investment, where the exposure runs for decades
- Responding to insurer or customer questionnaires on climate resilience
- Feeding the physical risk component of a corporate disclosure prepared elsewhere
Not for
- The corporate disclosure itself, which is prepared against a reporting standard with its own scope, assurance and governance requirements
- The greenhouse gas inventory, which measures emissions rather than assessing risk to the site
- Scenario analysis at group level, which uses defined climate pathways and time horizons
- The business continuity plan, which responds to disruption rather than assessing likelihood
- Energy and decarbonisation initiatives, which address transition rather than physical exposure
Standards
What it is built against
Climate risk is regulated through environmental management systems, disclosure regimes and, increasingly, insurance and customer requirements that move faster than either.
| Clause | Requirement | Where it lands |
|---|---|---|
| ISO 14001 cl.6.1.1 | Risks and opportunities determined considering context, interested parties and environmental conditions | Header |
| ISO 14001 cl.6.1.2 | Environmental aspects including those affected by changing environmental conditions | Physical risks |
| ISO 14001 cl.8.2 | Emergency preparedness and response, tested periodically and revised after events | Operational effects |
| IFRS S2 | Climate-related risks and opportunities, governance, strategy, risk management, metrics and targets | Transition risks |
| ESRS E1 | Climate change disclosure under CSRD, applying double materiality | Outcome |
| TCFD | The four-pillar structure underlying both IFRS S2 and ESRS E1: governance, strategy, risk management, metrics | Header |
| California SB 261 | Climate-related financial risk report for qualifying entities doing business in California | Outcome |
| ISO 45001 cl.6.1.2 | Hazard identification covering heat exposure and extreme weather affecting workers | Operational effects |
What it does not cover
- The corporate climate disclosure, prepared against IFRS S2, ESRS E1 or a state requirement with its own governance and assurance.
- The greenhouse gas inventory, which quantifies emissions rather than assessing exposure.
- Group scenario analysis, which applies defined pathways and time horizons across the portfolio.
- The business continuity plan, which addresses response and recovery rather than likelihood and exposure.
- Heat stress risk assessment for workers, which is an occupational health assessment with its own controls.
Filling it in
Filling it in well
A site climate assessment is useful when it produces decisions about assets and contracts. Four things make that likely.
An assessment with no horizon defaults to today, which is the one period where climate risk is least material. State the horizon, typically aligned to asset life or investment period, and the scenario used. Without both, findings cannot be compared between sites or carried into an investment case.
A flood map tells you the hazard. What matters operationally is what floods: the substation, the raw material store, the only access road, the car park that becomes the reason nobody can get to work. Walking the site against the hazard produces findings that a map alone does not.
Where an input has a single source or a single route, the site's own exposure is not the binding constraint. Identifying which inputs are sole-sourced and where those suppliers sit is a short exercise that frequently reframes the whole assessment.
An assessment that concludes the site is moderately exposed and recommends monitoring has produced nothing. Useful outputs are specific: relocate the electrical intake, add a bund, dual-source an input, change the insurance excess, or accept the risk with a named owner. That is also what an insurer or customer is actually asking for.
Audit findings
Common audit findings
Findings here concern scope, horizon and whether anything followed.
| Finding | Clause | What fixes it |
|---|---|---|
| Assessment covers the site only, with no supply chain or logistics exposure. | ISO 14001 cl.6.1.1 | Reach one tier upstream on sole-sourced inputs and single routes. |
| No stated time horizon, so the assessment defaults to present conditions. | IFRS S2 | State the horizon against asset life and the scenario used. |
| Physical hazard identified without operational consequence assessed. | ISO 14001 cl.6.1.2 | Walk the site against the hazard; the map does not know where the substation is. |
| Transition risk omitted entirely. | ESRS E1 | Cover policy, market, technology and reputational exposure alongside physical. |
| Assessment produces monitoring recommendations rather than decisions. | ISO 14001 cl.6.1.4 | Require a decision per material finding: mitigate, transfer, avoid or accept with an owner. |
| Worker heat exposure not connected to the occupational health assessment. | ISO 45001 cl.6.1.2 | Link chronic heat findings to heat stress controls; they are the same exposure. |
| Assessment not refreshed after a flood or heat event on site. | ISO 14001 cl.8.2 | An event is new information; refresh rather than waiting for the two-year cycle. |
| Data collected cannot support the disclosure the group must make. | IFRS S2 / ESRS E1 | Align site data collection with what the reporting standard actually requires. |
| Emergency arrangements not tested against the identified scenario. | ISO 14001 cl.8.2 | Test the scenario the assessment identified, not the one that is convenient to rehearse. |
| Reporting scope relief treated as removing the risk. | ISO 14001 cl.6.1.1 | Insurers and customers ask regardless; scope changes affect disclosure, not exposure. |
Worked case
Case in point: the year the rules moved and the risk did not
Between 2025 and 2026 the disclosure landscape changed sharply. The EU adopted a stop-the-clock directive in April 2025 delaying later CSRD waves by two years, then adopted the Omnibus I directive in February 2026, raising thresholds so that by most estimates 85 to 90 percent fewer companies fall within mandatory scope. EFRAG's simplified standards cut data points by around 61 percent and abandoned sector-specific standards. In the United States the SEC stopped defending its climate rule and proposed rescinding it.
For many operations that was read as the obligation going away. Meanwhile ISSB-aligned reporting became mandatory in Brazil, Mexico and Chile from 2026, Australia continued its phased introduction, California proceeded with SB 253 and SB 261 despite challenge, and more than twenty jurisdictions adopted or proposed IFRS S1 and S2.
And underneath all of it, insurers continued repricing flood and storm exposure, and customers continued sending resilience questionnaires that have nothing to do with any directive.
Definitions
Definitions and key terms
- Physical risk
- Direct effects of climate on assets and operations, divided into acute events and chronic shifts.
- Transition risk
- Exposure arising from the move to a lower-carbon economy: policy, market, technology and reputational change.
- Double materiality
- The CSRD approach requiring disclosure of both how sustainability affects the company and how the company affects environment and society.
- Financial materiality
- The IFRS S1 and S2 approach, addressing only what affects the entity's prospects, cash flows and cost of capital.
- Scenario analysis
- Assessment of resilience against defined climate pathways over stated time horizons.
- Acute physical risk
- Event-driven exposure: flood, storm, wildfire, extreme heat episodes.
- Chronic physical risk
- Longer-term shifts: rising mean temperature, water stress, sea level, changed precipitation patterns.
- ESRS
- European Sustainability Reporting Standards, the technical content under CSRD, simplified through the Omnibus process.
FAQ
Frequently asked questions
Has climate reporting been rolled back?+
Narrowed rather than removed, and unevenly. The EU's Omnibus I directive, adopted in February 2026, raised CSRD thresholds so that by most estimates 85 to 90 percent fewer companies fall within mandatory scope, and simplified standards cut data points substantially. In the United States the SEC ceased defending its climate rule and proposed rescission. At the same time ISSB-aligned reporting became mandatory in a widening set of jurisdictions and California's requirements proceeded. The obligation depends heavily on where you operate and who your customers are.
What is the difference between CSRD and ISSB requirements?+
Materiality model, principally. CSRD applies double materiality, requiring disclosure of both how climate affects the company and how the company affects the environment. IFRS S1 and S2 address financial materiality only. CSRD is binding EU law transposed into national statute; ISSB standards are a voluntary global baseline that becomes binding only where a jurisdiction adopts them.
Should we still assess if we are out of reporting scope?+
Yes, on operational grounds. Insurers price flood and storm exposure regardless of disclosure requirements, customers send resilience questionnaires regardless, and the substation floods regardless. Scope relief changes what must be published; it does not change what happens to the site.
What time horizon should the assessment use?+
One aligned to the decisions it informs, typically asset life or investment period. An assessment with no stated horizon defaults to present conditions, which is where climate risk is least material and least useful. State the horizon and the scenario, so findings can be compared across sites and carried into a capital case.
What is most often missed?+
Supply chain and logistics exposure. Sites assess their own flood zone thoroughly and stop there, while the interruption arrives through a sole-source supplier on a flood plain, a single port, or a road network that closes. Reaching one tier upstream on sole-sourced inputs is a short exercise and frequently changes the conclusion.
The agents
What the agents do with it
The assessment produces findings about assets and contracts. What fails is the exposure one tier upstream and the finding that closed as monitor.
Holds the assessment against the site, its assets and its permits, and refreshes it when an event provides new information rather than at the cycle.
Identifies sole-sourced inputs and single routes, so the assessment can reach the exposure that sits outside the fence.
Connects physical findings to the assets affected, so relocating an intake or bunding a substation becomes work rather than a recommendation.
Aligns site data collection with what the applicable reporting standard requires, so the operational assessment also feeds the disclosure.
This template lives in KnowEnviro — environment and energy. Aspects, permits, waste, emissions, spills and sustainability reporting.
Sources
Sources
- ISO 14001:2015 clauses 6.1.1, 6.1.2 and 8.2
- IFRS S2 Climate-related Disclosures, IFRS Foundation
- ESRS E1 Climate change, and the Omnibus I Directive adopted February 2026
- EFRAG simplified ESRS technical advice, December 2025
- California SB 253 and SB 261 climate disclosure requirements