Climate Risk Assessment: A Practical Guide for Organisations
A climate risk assessment is a structured way to find out how climate change could affect your operations, assets, supply chains and people, now and in the future, and what to do about it. One professional definition describes it as identifying, evaluating and responding to potential impacts. This guide shows you how to do that in practice: what to assess, the steps to follow, how mapping and scenario analysis fit in, and how to pick tools without buying more than you need.
Key Takeaways
A good assessment goes beyond a list of hazards. It traces each hazard through exposure and vulnerability to a real operational impact, then to an action.
Follow a repeatable sequence: prepare, set scope, gather climate data and scenarios, assess impacts, plan adaptation, then monitor and review.
Scenario analysis tests how resilient you are across several plausible futures. It is not a forecast.
Maps are excellent for showing where risk sits, but they have known limits, such as weak treatment of uncertainty and missing future projections.
Choose tools after you have defined scope and time horizons, not before.
What a climate risk assessment is, and why organisations do one
The core idea is simple. You look at what you depend on (sites, equipment, staff, suppliers, customers, communities), work out how a changing climate could disrupt it, and rank those risks so you know where to act first.
There are practical reasons to do it beyond good intentions. The Environment Agency’s guidance on climate risk assessment and adaptation planning in your management system, published on 3 April 2023 for businesses in England, says planning can help you stay compliant with environmental permits and other obligations, limit environmental impacts during extreme weather, and improve resilience and business continuity by avoiding unplanned start-ups, shutdowns and other interruptions.
The same exercise also feeds reporting. If you disclose against a climate framework, or your investors, lenders and customers ask about climate resilience, a documented assessment is the evidence base. For the wider picture of how climate failure connects to economic and societal risk, see our piece on the interconnected web of environmental, geopolitical, economic and societal risks.
Physical risk and transition risk
Most frameworks split climate risk into two families.
Physical risk comes from the climate itself. The EU guide to climate risk assessment separates slow-onset changes, such as shifts in mean temperature, mean precipitation and sea-level rise, from extreme weather events such as droughts, floods and heatwaves. Either can create hazards that affect people, ecosystems, assets and services.
The CFRF banking guide, hosted by the FCA and published in 2022, lists the principal physical hazards as floods, subsidence, coastal erosion, storms, wildfires, extreme freeze and thaw, heat stress and drought-related damage. That is a useful checklist for a UK or European site register.
Transition risk comes from the shift to a low-carbon economy: policy changes, technology shocks, changing customer expectations and market repricing. The NGFS notes that short-term scenarios are increasingly relevant for near-term risks tied to policy, technology shocks or extreme weather. For most organisations, physical and transition risks should be assessed together, because the same site or supplier can be exposed to both.
The six steps of a climate risk assessment
The ICAO’s climate risk assessment and adaptation report was written for aviation, but its six-step sequence works for almost any organisation. Here it is with practical notes.
1. Prepare the organisation
Name an owner and a small cross-functional team: operations, facilities, finance, procurement, health and safety, and sustainability. Agree what decisions the assessment should inform. Without that, you end up with a report nobody uses.
2. Define the scope
Decide which sites, activities, products and value-chain stages are in, and which time horizons you will examine. A common approach is to look at the present day, the medium term (the life of current investments) and the long term. Match the horizon to the life of the asset: a warehouse lease and a coastal port need different views.
3. Collect climate data and choose stressors and scenarios
Identify which climate hazards matter for your locations, then gather observed and projected data for them. This is also where you choose the scenarios you will test, covered in detail below.
4. Assess impacts
For each hazard, assess exposure (what is in harm’s way), vulnerability (how badly it would be hurt) and the resulting impact. The next section works through an example.
5. Finalise the assessment for adaptation planning
Rank risks, document assumptions and agree responses: avoid, reduce, transfer or accept. Our guide to risk response considerations covers how to choose among them, and our explainer on risk impact and likelihood shows how to rate and prioritise.
6. Monitor and review
Climate data, your asset base and regulation all change. Set a review cycle and a trigger list, for example a major flood event, a new site or a new supplier.
The ICAO report’s real strength is that it links hazards to asset lifecycles, dependencies, external stakeholders and adaptation planning, rather than stopping at a hazard inventory. That is the standard to aim for.
Hazard, exposure, vulnerability: how impacts are evaluated
The EU guide defines exposure as the presence of people, ecosystems, assets or services in places that could be affected. It defines vulnerability as a product of sensitivity and adaptive capacity, and it describes risk assessment as rating the likelihood and magnitude of potential impacts.
The UK government’s climate scenario analysis data guidance recommends keeping hazard, exposure and vulnerability separate, then tracing each hazard through operational impacts such as service disruption, reduced capacity and safety issues. It also points to wider outcomes, including harm to vulnerable groups and failure of statutory duties.
The ICAO adds that the assets you assess should include infrastructure, operations and, where relevant, personnel. It says to consider lifecycle, dependencies and effects on external stakeholders, and notes that impacts range from minor to significant depending on location, resilience and existing adaptation.
A worked example (illustrative)
Imagine a mid-sized food manufacturer with one plant on a river floodplain and key ingredients sourced from a drought-prone region. The table below shows how the logic runs. The ratings are invented for illustration only.
Element | Flood at the plant | Drought in the supply region |
|---|---|---|
Hazard | River flooding | Prolonged water scarcity |
Exposure | Production hall and cold store sit in the floodplain | Two main suppliers in the affected area |
Vulnerability | No flood barriers, electrics at ground level | Little alternative sourcing, thin stock buffers |
Operational impact | Line shutdown, spoiled stock, safety hazards | Input shortages, price spikes |
Wider impact | Staff unable to work, customer penalties | Supplier failure, reputational risk |
Possible response | Raise electrics, install barriers, flood plan | Qualify second suppliers, hold buffer stock |
Notice that the response comes from the vulnerability column. Where the exposure cannot be changed quickly, you reduce sensitivity or raise adaptive capacity.
Water is often the hazard that links everything else. Our water risk assessment guide for organisations goes deeper on scarcity, flooding and quality.
Climate risk mapping: what it shows and where it misleads
Mapping puts hazard, exposure and vulnerability on a geographic base so you can see where risk concentrates. The European Climate Risk Typology is a good example. It combines hazard, exposure and vulnerability indicators to group European cities and regions with similar risk characteristics, which can inform risk assessments, adaptation strategies and comparisons between places.
Maps are ideal for portfolio screening: you can rapidly see which of 200 sites deserve a closer look. They are less suited to deciding exactly how to protect one building.
A systematic review of climate vulnerability mapping identified recurring limitations: missing future climate and socioeconomic projections, insufficient treatment of uncertainty, difficulty validating maps, and too little engagement with policy audiences. In practice, use maps to prioritise, then confirm the high-risk sites with local data and site visits.
Climate scenario analysis
Scenario analysis is where many first-timers stumble, so it helps to be clear about what it is.
According to the LSEG guide to climate reporting, which draws on the TCFD, scenarios are hypothetical constructs. The analysis evaluates a range of plausible futures to test resilience. It is neither a forecast nor a sensitivity analysis.
The CFRF guide defines a scenario as climate and macroeconomic variables combined with modelling choices and assumptions about technology, policy, energy mix, innovation and economic behaviour. It advises choosing scenarios to suit the purpose, coverage, granularity, time horizon, assumptions and limitations of the exercise.
How to choose scenarios and horizons
Start with the question. Are you testing a site investment, a supply chain, or the whole strategy? The question sets the horizon.
Use a range. The Johannesburg Stock Exchange’s climate disclosure guidance recommends a range of scenarios, including some where the Paris temperature goal is met and some where it is not.
Pick the method that fits your data. The same guidance allows qualitative narratives, quantitative models or a combination.
Customise, then explain. Its practical advice is to adapt established public scenarios around your material risks and explain any modifications and assumptions.
Match short and long views. The NGFS says short-term scenarios suit near-term policy, technology or extreme weather shocks, while long-term scenarios explore how the global economy and financial system might evolve over the rest of the century amid uncertainty.
TCFD and today’s disclosure rules
The JSE guidance describes the TCFD recommendations as built around four thematic areas: governance, strategy, risk management, and metrics and targets. Scenario analysis sits mainly under strategy, where you describe how resilient your strategy is under different climate outcomes. Even if you are not formally required to disclose, organising your assessment around those four areas gives it a structure that investors and lenders recognise. Check the current requirements that apply to your jurisdiction and legal form before committing to a reporting format.
What scenario analysis examples tend to look like
Whatever the sector, a useful scenario exercise has the same shape. It sets out two or three contrasting futures, for instance an orderly transition, a delayed or disorderly one, and a high-warming world with limited policy action. It states assumptions for each, then asks the same questions: which sites, products or revenue lines are affected, how severely, and when? The output is a set of resilience findings and decisions, such as moving a planned facility, diversifying suppliers or changing the capital plan. A published example from the financial sector is the CFRF banking guide above. Public-sector bodies can follow the UK government data guidance, which sets out what internal data to collect before running the exercise.
For a corporate example of climate risk management reported in an ESG report, see our write-up of AIG’s ESG report and its climate risk management.
Choosing climate risk tools
The market for climate risk tools ranges from free public data portals to specialist analytics platforms and ESG reporting software. Rather than hunting for a single best option, match the tool type to the job.
Tool type | Best for | Watch for |
|---|---|---|
Public hazard maps and open datasets | First-pass screening of sites | Resolution, and whether future projections are included |
Screening frameworks from development bodies and regulators | Structured project-level checks | Built for a specific sector or purpose |
Spreadsheet or workshop templates | Qualitative assessments, small organisations | Consistency across sites and years |
Analytics platforms | Large portfolios, quantified financial impact | Transparency of scenarios and assumptions |
ESG reporting software | Storing assessments, linking risks to disclosures and metrics | Fit with the frameworks you report against |
Whatever you choose, check four things:
Scenarios: can you see which scenarios and assumptions sit behind the outputs, and can you change them?
Time horizons: do they match the life of your assets?
Uncertainty: does the tool show ranges, not one number?
Audit trail: can you document how each rating was reached, so the assessment survives scrutiny next year?
The tool should serve your scope, not define it. Settle steps one and two first.
Common mistakes to avoid
Stopping at a hazard list. A list of floods and heatwaves is not an assessment until it reaches impacts and actions.
Ignoring dependencies. Your site may be safe while your power, transport links or key supplier are not. The ICAO explicitly asks you to consider dependencies.
Treating scenarios as predictions. Use a range and explain your assumptions.
Over-trusting a single map. Validate high-risk results locally.
Forgetting people. Staff, vulnerable groups and statutory duties belong in the impact assessment, as the UK government guidance says.
One and done. Build the monitoring and review step into the calendar.
How Exereco can support your assessment
If you want help turning an assessment into a working programme, Exereco combines sustainability news and analysis focused on Europe and Africa with ESG advisory, training, reporting software and community networking in one platform. Our approach is designed to help organisations tailor their climate and ESG work to European and African contexts.
To see how our offer connects to climate resilience work, visit our SDG 13: Climate Action page, or read about climate and water crises solutions. For infrastructure-focused organisations, our page on SDG 9: Industry, Innovation and Infrastructure is a good starting point.
FAQ
What is the difference between physical and transition climate risk?
Physical risk comes from the changing climate itself, such as floods, heatwaves, drought, storms and sea-level rise. Transition risk comes from the shift to a low-carbon economy, through policy, technology and market changes. Most organisations face both, and a complete assessment looks at each.
How often should we review a climate risk assessment?
The ICAO sequence ends with monitoring and review, but it does not fix a single interval for every organisation. Set a regular cycle, such as annually, and add triggers like a major weather event, a new site or a significant change in suppliers or regulation.
Is scenario analysis the same as a forecast?
No. The LSEG guide, drawing on the TCFD, describes scenarios as hypothetical constructs used to test resilience across plausible futures. You use several, with stated assumptions, to see how your strategy holds up rather than to predict one outcome.
Do small organisations need scenario analysis?
Not necessarily in a quantified form. The JSE guidance accepts qualitative narratives, quantitative models or a combination. A small organisation can run a workshop-based exercise with two or three contrasting narratives, then record the decisions that follow.
Where should I start if I have no climate data?
Begin with scope: list your sites, key suppliers and critical dependencies. Then use public hazard datasets and maps for a first screening, and follow up on the highest-risk locations with more detailed data and site knowledge.
Recommended
Comments