Water Risk Assessment: A Practical Guide for Organisations
A water risk assessment is a structured way of finding out where water could hurt your organisation, where your organisation could hurt shared water resources, and what you will do about it. In business and ESG work, it looks at two things together: the conditions in the river basin where you and your suppliers operate, and the way your own operations use and affect water. In UK building management, the same phrase usually means something narrower, a Legionella or water-hygiene check. This guide covers both meanings, but spends most time on the corporate one.
Key takeaways
A useful assessment combines basin conditions (the catchment you depend on) with operational conditions (how you use, treat and discharge water), because both drive risk exposure.
Decide your geographic and value chain scope first. The tool comes second.
Rank findings and focus on a manageable set of acute risks, then turn them into controls, targets and disclosure.
Review the assessment when something material changes, such as a new site, a drought, a new supplier or a change in regulation, not only on a calendar.
A Legionella risk assessment is a legal health and safety duty for premises in Great Britain. It is a different exercise from a corporate water risk assessment.
What water risk means
Water risk is the chance that water problems damage your organisation, or that your organisation contributes to water problems for others. The CEO Water Mandate, a UN-backed corporate initiative, groups business water risk into three types:
Physical risk: problems with the quantity, quality or accessibility of water, such as drought, flooding or contaminated supply.
Regulatory risk: changing or ineffective water policy, including abstraction limits, discharge standards and pricing.
Reputational risk: how customers, communities, investors and other stakeholders perceive your handling of water.
The same source also splits risk by origin: risks caused by your own operations, products and services, and risks caused by basin conditions where you or your suppliers sit. A factory with efficient processes in a stressed basin still has a basin risk. A factory in a wet region with leaky processes and poor effluent control has an operational one.
Why it is rising up the agenda
The scale is not small. The WWF Water Risk Filter guide reports that 17% of the global population and 10% of global GDP sit in regions of high water risk, projected to reach 51% and 46% by 2050 as climate and socio-economic conditions change. The same guide cites a CDP estimate that water-related risks represented a US$301 billion threat to the bottom line of global businesses in 2020.
For a UK organisation, that exposure often sits abroad: in cotton, food, minerals or electronics suppliers located in basins you have never visited. That is why scope matters so much.
Step by step: how to carry out a water risk assessment
There is no single mandated method for corporate water risk. The steps below follow the logic of the CEO Water Mandate and WRI guidance, set out in a form a sustainability or facilities team can run in a few weeks for a first pass.
1. Set the scope
The CEO Water Mandate notes that the proliferation of tools has caused user confusion, and that you should settle your geographic and value chain scope before running any assessment. Write down:
which sites, countries and business units are in
whether you include tier-one suppliers, or deeper tiers
the purpose: internal risk management, investor disclosure, target setting, or all three
2. Map water dependencies and impacts
Companies can assess water materiality by looking at dependencies and impacts across the value chain. A dependency is how exposed you are to water challenges, for instance a process that stops without a steady supply. An impact is your contribution to shared water challenges, such as abstraction from a stressed aquifer or discharges that degrade a river.
A simple register works: one row per site or supplier group, with columns for water source, volume used, quality needs, discharge route and what happens if supply fails for a week.
3. Gather basin data
Locate each site in its basin and check indicators such as scarcity, pollution, flood exposure and the state of local governance. The WWF Water Risk Filter is a free online tool built for this, and its guide explains how to use it. Use globally comparable data so that sites in different countries can be ranked on the same footing. The CEO Water Mandate advises that, to prioritise locations for targets, companies should map facilities against globally comparable information on shared water challenges.
Then add local detail the global tools miss: abstraction licence conditions, drought plans from the local water company or regulator, and flood maps.
4. Include your supply chain
This step is the one most often skipped. WRI reports that companies including supply chains in their assessments are seven times more likely to identify supply chain risks. Start with your highest-spend or highest-water-intensity categories, ask suppliers for site locations, and run those locations through the same basin screen.
5. Score and prioritise
Combine likelihood and consequence for each risk, and record both exposure and your response. The CEO Water Mandate stresses that understanding exposure and the corporate response is essential to judge residual risk. A site in a high-stress basin with recycling, storage and a backup supply has a lower residual risk than the raw basin score suggests.
If you end up with dozens of risks, do not try to manage all of them. Companies can identify a manageable subset, concentrating on the most acute risks or those to which the company is broadly exposed.
The prioritisation logic is close to the one used in materiality work. If you already run a materiality exercise, our guides to double materiality assessment and drawing a materiality matrix show how to rank topics by financial and impact significance. Water can be plotted on the same matrix.
6. Decide on controls and targets
Turn each priority risk into an action with an owner and a date. Typical responses include:
efficiency, reuse and leak reduction at your own sites
backup supply or storage at sites exposed to scarcity or disruption
changes to effluent treatment
supplier engagement and procurement requirements
participation in catchment-level collective action
WRI suggests that addressing value chain water risk requires moving beyond internal assessment to engage suppliers, amend procurement policies and collaborate on collective action.
7. Record and report
When reporting water risks, advanced disclosers identify the geographic area, the risk category and driver, the potential consequences and the estimated timeframes. The consequences might be higher operating costs or closure of operations. A short table per priority risk is enough, as in the example below.
Field | Example entry |
Location | Packaging supplier, tier one, one named site |
Risk category | Physical (scarcity) |
Driver | Basin conditions |
Consequence | Production interruption, higher input cost |
Timeframe | Medium term |
Response | Dual sourcing, supplier water plan |
The table is an illustration of the format, not data from a real company.
Tools and frameworks worth knowing
You do not need all of these. Choose by purpose.
Type of resource | What it does | Best used for |
Basin screening tools such as the WWF Water Risk Filter | Scores locations on physical, regulatory and reputational indicators | First-pass screening of many sites |
Resilience frameworks such as the UN Global Compact’s WRAF | Step-wise approach with a scoring tool for corporates | Deeper work on priority basins |
Value chain guidance from WRI | Sets out how to treat water across scopes 1 to 3 | Supplier and upstream risk |
Disclosure guidance from the CEO Water Mandate | Shows what to include when reporting risks | Preparing public disclosure |
Internal registers and site audits | Capture actual volumes, quality and incidents | Operational risk, controls |
The Water Resilience Assessment Framework offers a standard, step-wise approach to measuring resilience, including a Resilience Scoring Tool for corporates. Its 2024 guidance says a holistic approach, covering socio-economic, institutional and biophysical components, is particularly useful where catchment management is immature or ineffective. That makes it relevant for operations and suppliers in regions with weaker water governance, including many parts of Africa.
Learning from large water users
Companies with heavy water footprints publish how they think about basin-level risk. Our write-ups of Coca-Cola’s watershed approach and Meta’s water positivity claims show how a basin-focused view is turned into targets, and where the claims deserve scrutiny. Smaller organisations can borrow the method without the scale: know your basins, set targets by location, and report progress with evidence.
Connecting water risk to ESG reporting
Water findings feed directly into sustainability disclosure. A good assessment gives you the material topics, the metrics (withdrawal, consumption, discharge, share of sites in high-stress basins) and the narrative on risk and response. If you report against GRI, water sits in its own topic standard, and our GRI reporting course walks through how to structure disclosures from the data you have collected.
WRI and partners are also developing standardised value-chain water guidance, intended to lower reporting barriers and streamline inputs for voluntary initiatives. Building your supplier data now puts you ahead of whatever format wins.
How often to review it
There is no universal interval for corporate water risk. The principle from drinking water practice is sound, though: periodically review and update the assessment, because changing conditions can introduce new hazards or change existing ones.
Some regulated utilities do have fixed cycles. For US community water systems serving more than 3,300 people, the EPA says risk and resilience assessments must be reviewed at least every five years. That is a US rule for utilities, not a UK requirement for companies, but it is a reasonable outer limit to borrow.
For a company, set an annual light-touch review and trigger a full update when:
you open, close or acquire a site
a key supplier changes location
a drought, flood or pollution incident hits a priority basin
abstraction, discharge or reporting rules change
your own water use changes materially
How this differs from a Legionella risk assessment
In the UK, searching for a water risk assessment often returns Legionella results, and for good reason. They answer a different question.
Corporate water risk assessment | Legionella risk assessment | |
Question | How do water scarcity, quality, regulation and reputation affect us, and what do we affect? | Could people be exposed to Legionella bacteria from our water systems? |
Scope | Basins, sites, value chain | A building’s water systems: tanks, pipework, cooling towers, showers |
Status | Mostly voluntary, driven by risk management and disclosure | A legal duty for employers and those in control of premises |
Who does it | Sustainability, risk and procurement teams | A competent person, often an external specialist |
Output | Risk register, targets, disclosure | Written assessment and control scheme |
The HSE’s approved code of practice, L8, is aimed at dutyholders and covers identifying and assessing sources of risk, preparing a control scheme and keeping records. If you manage commercial buildings, a practical Legionella risk assessment guide explains what the assessment covers and how to act on it.
The two meet at the facilities level. A site that does well on Legionella control will have good records of its water systems, which makes the operational half of a corporate assessment much easier. But passing one does not satisfy the other.
Where Exereco can help
Water is one topic inside a wider ESG programme, and most teams struggle less with the theory than with joining up data, materiality, reporting and training. Exereco brings news and analysis, ESG reporting software, advisory support and training together, with a focus on European and African contexts. If you are building water into your reporting, start with the GRI reporting course, or see what else we offer on the Exereco homepage.
FAQ
What is a water risk assessment?
It is a structured review of how water-related hazards could affect an organisation and how the organisation affects water resources. For businesses it covers physical, regulatory and reputational risk, drawing on both basin conditions and company operations. In UK property management, the phrase often refers to a Legionella assessment of a building’s water systems.
Is a water risk assessment a legal requirement in the UK?
A Legionella risk assessment is: employers and those in control of premises must identify and assess sources of risk, under the framework the HSE’s L8 code describes. A corporate water risk assessment of basins and supply chains is generally voluntary, though it may be needed to answer investor, customer or sustainability reporting requests.
How long does a corporate water risk assessment take?
A first screening of a handful of sites using a free basin tool can be done in a few weeks. Adding supplier locations, local data and a scored risk register takes longer, depending on how many sites and suppliers you include. Settle your scope first, since that is the biggest driver of effort.
How often should it be reviewed?
Review it whenever conditions change materially, and at least annually in a light-touch form. US rules for regulated utilities set a five-year cycle, which can serve as a long-stop. For Legionella, check the HSE guidance and ask your competent person to set the review interval for your premises.
Which tool should I start with?
Start with a basin screening tool to locate your sites and suppliers in their basins, then move to a resilience framework for the few locations that score worst. Which one fits depends on your scope and whether the output is for internal risk management or public disclosure.
Recommended
Comments