Sustainability risk assessment tool - The Sustainability Management Wiki

Authors: Philine Jörgensen, Lisann Kühling, Katharina Ros
Edited by:
Last updated: June 23, 2026

Executive summary

Sustainability risks are business risks. Climate change, social harms, weak governance, and regulatory change can affect supply chains, production sites, investments, workforce productivity, insurance costs, reputation, and access to capital. The article frames sustainability risk through the ESG dimensions: environmental impacts and dependencies, social issues such as labor standards and living wages, and governance topics such as compliance, corruption prevention, controls, and transparent reporting. EU frameworks such as the Taxonomy Regulation, CSRD, and Corporate Sustainability Due Diligence Directive increase the need for structured, documented risk management.

Existing approaches range from established frameworks such as COSO ERM and ISO 31000 to classic tools such as risk matrices, scenario analysis, and FMEA. These methods help organizations identify, evaluate, and prioritize risks, but they can be too general, resource-intensive, subjective, or difficult to tailor. Commercial GRC platforms provide automation, AI-supported analytics, and reporting capabilities, yet they may involve high cost and implementation effort. Free spreadsheet-based tools remain widely used because they are accessible, familiar, and adaptable.

The Sustainability Risk Assessment Tool presented in the article is an Excel-based template designed to help organizations systematically identify, assess, manage, and monitor ESG risks. It includes worksheets for navigation, stakeholder analysis, simplified materiality analysis, governance responsibilities, ESG risk assessment, action planning, KPI tracking, dashboards, and scenario analysis. The tool combines qualitative and quantitative inputs, including risk categories, time horizons, stakeholder impact, resilience, financial impact, probability, severity, risk appetite thresholds, and target risk scores.

For practitioners, the tool supports a practical workflow: map stakeholders and expectations, identify material sustainability topics, assign governance responsibilities, define risk appetite, assess ESG risks, prioritize actions, monitor implementation progress, and test resilience through scenarios. Its main strengths are accessibility, low cost, transparency, and compatibility with familiar spreadsheet workflows. Future improvements should deepen dashboard diagnostics, integrate external data sources, add stress testing, and automate more processes to reduce errors and increase scalability.

1 Motivation and background

Sustainability has gained increasing importance in recent years and now shapes social, political, and economic discourse. It means meeting current needs without compromising the opportunities of future generations. Sustainability is also becoming increasingly important for companies. For example, insurers do not raise premiums and deductibles for flood risks because companies have made mistakes. Rather, it becomes clear that sustainability risks are already reflected in market prices – highlighting the extent to which climate change has already progressed.

According to the World Meteorological Organization, the clearly recognizable signs of anthropogenic climate change reached a new intensity in 2024.¹^,² 2024 was the warmest year since records began in 1850.³ According to this year’s report on the state of the global climate, some effects of climate change will remain irreversible for centuries or even millennia.⁴ Serious consequences also include rising sea levels and glacier melt.³ This is because sea levels continued to rise due to thermal expansion and meltwater, and glacier mass loss continued, particularly in Norway, Sweden, Svalbard, and the tropical Andes.³ In many parts of the world, climate change has manifested itself in the form of extreme weather events: heat waves in eastern North America, Europe, North Africa, and South and East Asia, floods in East Africa and South America. In addition, there were droughts, tropical cyclones, and wildfires.³

This has an impact on society and the economy. Between 1970 and 2021, damage caused by extreme weather resulted in more than 2 million deaths and losses of 4.3 trillion US dollars.³^,⁵ Critical infrastructure, farmland, and biodiversity are among the areas particularly affected.³ For companies, this means increasing risks for supply chains, production sites, and investments. The human workforce becomes less productive or may not be able to work at all during extreme weather events. The example of insurance can also be revisited here: This is because insurance companies raise their prices when uncertainties increase.⁶ It is therefore important for companies to perceive sustainability risks as business risks. The Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin) also recommends that the companies it supervises pay even more attention to sustainability risks.⁷

But what does the term “sustainability risks” actually cover? BaFin includes events or circumstances in the areas of environmental, social, or corporate governance whose occurrence may actually or potentially have an adverse effect on the assets, financial position, and earnings of a supervised company as well as its reputation.⁷ The terms “environmental”, “social”, and “corporate governance” refer to “ESG risks”, which include sustainability risks.⁷

The “E” in ESG denotes the environmental dimension.⁷ Environmental criteria assess a company’s treatment of the natural environment.⁸ In the European Union, for example, Regulation (EU) 2020/852, the so-called Taxonomy Regulation, applies: It creates a uniform classification system that defines which economic activities are considered environmentally sustainable.⁹ The regulation sets out six environmental objectives: Climate protection; adaptation to climate change; sustainable use and protection of water and marine resources; transition to a circular economy; prevention and reduction of pollution; protection and restoration of biodiversity and ecosystems.¹⁰ This enables the practical implementation of the “E”: An economic activity is considered environmentally sustainable if it makes a substantial contribution to at least one of the environmental objectives mentioned, does not significantly affect the other environmental objectives, complies with the minimum protection requirements, and meets the Commission’s technical assessment criteria.¹⁰

The “S” in ESG refers to the social dimension.⁷ Social criteria assess how a company manages its relationships with employees, suppliers, customers, communities, and other stakeholders in its environment.⁸ Social risks relate, for example, to compliance with recognized labor law standards.⁷ This means that no child labor, no forced labor, and no discrimination are tolerated.⁷ Also included are certain requirements for the workplace, which must protect health, offer appropriate compensation, and provide training and further education opportunities.⁷

Regarding the example of child labor mentioned above, concrete figures are available that enable the extent of the problem to be assessed: New estimates from the United Nations Children’s Fund (UNICEF) and the International Labor Organization (ILO) suggest that around 138 million children worldwide are engaged in child labor, which has a negative impact on their educational opportunities and development.¹¹ Of these, around 54 million perform dangerous activities that threaten their health and safety.¹¹ Examples include work in gold mines, quarries, or cotton fields.¹² In particular, exploitative child labor in textile production has become the focus of public attention in recent years.¹² Exposure to hazardous chemicals and coercion into excessively long working hours violate the ILO’s “Decent Work Agenda”.¹² The use of child labor in companies’ supply chains is therefore often met with criticism and outrage and leads to reputational damage. This is because more and more stakeholders and consumers value transparent supply chains.

Fair pay is also gaining importance in terms of social sustainability. This is symbolized by the Dow Jones Sustainability Index, which has explicitly asked about fair wages since 2021.¹³ The need for fair wages is illustrated by the example of Bangladesh. There, the Fair Labor Association emphasizes the urgent need for a living wage, as wages were 51.78% below the Global Living Wage Coalition (GLWC) estimate for the 2022 living wage in the capital city of Dhaka.¹⁴ Poor pay has negative consequences for people’s health and education. In addition, garment workers in Bangladesh face challenges such as intimidation, violence, and legal hurdles.¹⁵ It is therefore very important for companies to exercise their due diligence responsibly and contribute to closing the wage gap.

The “G” in ESG refers to the dimension of corporate governance.⁷ Governance encompasses corporate governance structures, including the structure of executive remuneration, the implementation of audits and internal control mechanisms, and the protection of shareholder rights.⁸ This also includes tax compliance, combating corruption, and ensuring employee rights.⁷ The EU has created a binding framework through the Corporate Sustainability Reporting Directive, which requires companies to disclose their practices.¹⁶ An important term in this context is double materiality: Companies are responsible for transparently presenting how sustainability risks affect the company (“outside-in”, known as “financial materiality”) and how their economic activities affect the environment and society (“inside-out”, known as “impact materiality”).¹⁷ It can therefore be said that corporate management plays a crucial role. Only when leadership sets the right tone at the top can ESG strategies take effect.

A negative example is South Africa, a country heavily affected by corruption. Among others, former President Jacob Zuma was responsible for this. When he was sentenced to 15 months in prison, there was a brief spark of hope among the opponents of corruption. But this did not last long, as his lawyers argued that Zuma needed surgery, which led to his release despite corruption charges. It should be noted that the head of the prison service is a close confidant of Zuma and is himself the subject of numerous corruption allegations. Here, the metaphor of the “lever” that needs to be applied can obviously be explained in the opposite direction.¹⁸

At the EU level, sustainability issues are already being addressed, and regulation is increasing: In addition to the EU taxonomy and the Corporate Sustainability Reporting Directive already discussed, the Corporate Sustainability Due Diligence Directive is particularly relevant. The new rules ensure that the companies concerned identify, prevent, and mitigate the negative impacts of their business activities on human rights and the environment, both within Europe and worldwide. The directive aims to strengthen sustainable and conscientious business practices within companies and along their international value chains. Benefits of these rules include increased transparency and better protection of human rights. For companies, the introduction of the directive means fair competition and greater trust among employees and customers. In connection with sustainability risks, improved risk management and the reduction of liability risks are particularly relevant.¹⁹

The points mentioned above clearly show that sustainability risks are included in corporate practice. Progress has already been made in recent years: many companies now produce sustainability reports and inform the public about their environmental and social activities.²⁰ However, the assessment of sustainability risks is often very general and offers little opportunity for learning.²⁰ A sustainability risk assessment tool helps to identify and evaluate sustainability risks in a targeted manner and then take them into account in decision-making processes. It simplifies internal risk management and creates transparency by enabling risk analysis tailored to the company.

The tool developed here aims to make it easier for practitioners to incorporate sustainability risks into their companies. A major advantage is the ease of use of the Excel program. Excel is a platform that is already established in many companies and is user-friendly. This means that there are no additional licensing costs. Even small companies that do not (yet) have a sustainability department can benefit from this tool thanks to its free use and ease of handling.

This sustainability risk assessment tool aims to complement existing tools in a meaningful way. For classification purposes, an overview of existing tools is therefore provided first. The focus is on both the strengths and weaknesses of these tools to benefit from the findings when creating this new sustainability risk assessment tool. The developed tool is then presented, including its structure, focus, and user guides. It should be emphasized that, despite considerable effort, this tool cannot be considered perfect or fully up to date: Due to ongoing legislative changes, evolving legal precedents, different global practices, and other unforeseen events, a sustainability risk assessment tool will never be able to address all aspects to the necessary extent. Finally, existing articles on this wiki are critically examined and three suggestions for improvement are explained in more detail.

2 Existing tools / templates

The toolbox for risk and compliance managers contains a wide range of methods and analysis techniques that can be used to assess risks. The tools selected in each case depend largely on the risk data available. At the same time, the applicable laws, norms, and standards in risk management offer a comprehensive range of recommendations for action that organizations and companies of all sizes and in all industries can use for risk assessment.

The ISO 31000 standard and the COSO-Enterprise Risk Management (ERM) framework are among the world’s best-known risk management frameworks. Both frameworks provide a basis for the development and governance of risk management systems. The COSO framework has established itself as the international standard for enterprise-wide risk management, particularly in the USA, and is also used in Europe in connection with internal control systems.²¹ COSO stands for ‘Committee of Sponsoring Organizations of the Treadway Commission’ and is a private institution that develops frameworks for internal control, fraud prevention, and ERM, among other things. The framework, updated in 2017, is based on five components that can be tailored to the specific needs of organizations and applied regardless of industry and organizational size. The aim of the framework is to maintain and increase the value of the organization through a holistic view of risks. COSO thus pursues a value-oriented ERM approach by contributing to corporate value and supporting value-oriented decisions. However, the COSO framework is quite complex and is usually classified by experts as a practicable standard for large corporations.

ISO 31000, on the other hand, was developed based on the ‘top-level approach’ and aims to create a uniform understanding of risk management. The standard is intended to link the risk management system to a company’s existing management systems and to be implemented as an active and preventive control system. Critics complain, however, that the standard is too general, based on the ‘lowest common denominator’ approach, and therefore does not sufficiently consider important company- and industry-specific requirements. The COSO framework is also criticized for this, as it only reflects a comparatively low level of maturity in corporate risk management. Although both frameworks provide a structural framework, neither offers concrete methodological approaches nor detailed solutions for specific issues. Companies need tangible tools for the concrete implementation of risk management. Only through the use of practical instruments and templates can risks be systematically recorded, evaluated, and prioritized.²¹

2.1 Classic risk assessment tools

Classic risk assessment tools such as the risk matrix play an important role here. The risk matrix helps organizations analyze different risk levels and make informed risk decisions on this basis.²² It is essentially a tool for subjective risk assessment, which is used, among other things, in process hazard analyses. The tool is based on the definition of risk as a combination of the severity of possible consequences and the probability of the risk occurring. When creating the risk matrix, these probabilities are categorized and scaled to determine a risk index. The results are then presented graphically in the form of a matrix.²³ Typically, the y-axis represents the probability of occurrence and the x-axis represents the severity. The combination of these dimensions reveals a ranking of company-specific risks, which can be used to derive prioritized measures.²⁴

However, for the assessment to be reliable, the necessary information on probabilities and consequences must first be collected; in practice, these are usually vague and not easily quantifiable. The subsequent classification into fixed categories therefore leads to important nuances being lost and the assessment losing accuracy.²⁴

Scenario analysis is also one of the classic tools of risk assessment. It supports risk management by enabling companies and organizations to systematically review strategies and decisions based on possible future scenarios. The aim of scenario development is to highlight the risks and sensitivities resulting from the scenarios and to improve risk management on this basis.²⁵ Scenario analysis has now established itself as a standard tool for strategic management, particularly in medium- to long-term planning. Possible scenarios relating to a country’s economic or social development, for example, help risk managers to prepare concrete contingency plans such as exit strategies.

The detailed description of how and why certain future scenarios could occur is particularly valuable in this context. This approach forces decision-makers to reflect on the possible effects of political, social and economic changes on their organization and to think through appropriate courses of action in advance. In this way, scenario analysis helps to make uncertainties more tangible and strategies more resilient. At the same time, however, it should be noted that this is not a universally applicable tool. The method must always be adapted to the specific context and tested in advance before it can be applied on a larger scale.²⁶ In addition, the development and implementation of well-founded scenarios requires a considerable investment of resources.²⁷

While scenario analysis is primarily used in strategic planning to anticipate possible future developments, failure mode and effects analysis (FMEA) focuses more on operational processes and systems. It is also one of the classic risk assessment tools and is used across industries to identify potential sources of error at an early stage and mitigate their effects. The aim of the method is to increase the reliability and safety of complex systems while providing sound information for risk-related decisions.²⁸ FMEA is based on a quantitative assessment of possible errors and their causes. Three key factors are considered: the severity of a potential error, the probability of occurrence, and the probability of detection. These dimensions result in the risk priority number (RPN). The higher this value, the greater the potential risk and the priority of initiating appropriate countermeasures.

In this way, FMEA not only supports the systematic recording of risks, but also the targeted prioritisation and use of resources. However, the tool requires critical awareness of its susceptibility to subjectivity and inconsistency.²⁹ Depending on the team composition, background knowledge, and perspective, the results may be inconsistent.³⁰

In addition to the classic risk assessment tools already presented, there are a number of other tools that are used in practice.²⁹

2.2 Digital software tools

With advancing digitalization and developments in the field of artificial intelligence, classic risk assessment tools are also available in the form of specialized software solutions. The ability to digitally store, classify and analyze large and diverse amounts of data opens up new ways for companies and organizations to perform risk assessments faster, more efficiently and accurately, and to better predict future developments.³¹

The IDC MarketScape: Worldwide Governance, Risk and Compliance (GRC) Software 2025 Vendor Assessment provides a comprehensive overview of the current providers of such solutions. In this analysis, several software providers were evaluated in terms of their range of functions, current market performance, future viability, and strategic vision, and classified as major players or leaders based on these criteria. Three of the identified leaders are presented in more detail below.³²

The report ranks the Diligent One Platform as the strongest leader.³² This is a cloud-based, AI-powered governance, risk and compliance (GRC) solution designed to combine governance and risk management in a single system. IDC MarketScape particularly highlights the platform for its modular platform architecture, strong board reporting capabilities and strategic roadmap. Diligent integrates risk management, audit process, ESG and diversity tracking capabilities, complementing them with AI-powered analytics and continuous risk monitoring.³³

However, this broad range of automation and governance capabilities also presents challenges. Implementation requires a significant initial investment and is associated with high costs, which can pose considerable hurdles, especially for smaller companies.³⁴

The OneTrust platform was also ranked as a leader in IDC MarketScape.³² This holistic GRC tool focuses in particular on third-party risk management, i.e. risk management in collaboration with external partners, suppliers, and service providers. This makes OneTrust particularly suitable for companies that need to monitor their supply chains in accordance with legal requirements such as the Supply Chain Due Diligence Act (SCDDA). With over 14,000 customers worldwide, OneTrust is considered one of the most widely used GRC tools on the market. Its automation is particularly praised, as the combination of artificial intelligence and flexible workflow design significantly reduces the burden on operational processes.³⁵

At the same time, however, there are also critical voices. For example, the lack of price transparency is criticized, and the multitude of configuration options is overwhelming, especially for smaller teams or less experienced users.³⁶

The last tool, which was also named a leader by IDC MarketScape, stands out thanks to its AI-driven analytics and comprehensive range of functions.³²^,³⁷ IBM OpenPages is a highly scalable, AI-supported tool for governance, risk and compliance, which was included in the leader category for the first time. The report highlights the tool’s comprehensive range of applications, functionality and strategic vision. By automating compliance processes and integrating watson.ai, GRC tasks are implemented more efficiently and soundly. In addition, the tool enables AI-based risk summaries and supports visual analysis of risks through heat map-like representations.³⁷

In addition to these extensive functions, however, the cost intensity and the considerable initial effort associated with the complexity of the tool are also criticized here.³⁸

While commercial platforms such as Diligent, OneTrust and IBM OpenPages offer a wide range of functions, in practice many companies continue to rely on free tools.³⁹

2.3 Free risk assessment tools

According to the Prevalent Third-Party Risk Management Study published in 2024, around 50% of the companies surveyed still prefer to work with spreadsheets such as Excel tools or ready-made templates.³⁹ Against this backdrop, here are three very different but freely available risk assessment tools.

The GIZ ESG Toolkit comprises four specialized instruments developed specifically for financial and credit institutions. It is the result of a collaboration between the Deutsche Gesellschaft für Internationale Zusammenarbeit (GIZ) and the Small Industries Development Bank of India (SIDBI). The aim was to create a practical working tool that enables the identification and management of ESG risks in the financial sector. The toolkit consists of the Initial Screening Tool, the ESG Due Diligence instrument, an ESG scoring system and monitoring and reporting formats. These tools can be used independently of each other or in addition to existing guidelines and frameworks such as the COSO framework.⁴⁰^,⁴¹

However, it should be noted that the toolkit has not been published comprehensively as an international standard, such as the ISO standards, and is therefore only available to a limited extent. Furthermore, it is purely a working tool that does not enable further data analysis and does not offer interfaces to other corporate risk dimensions outside of ESG issues.⁴⁰^,⁴¹

Another example of a free tool is the risk management tool from the German Bundesverwaltungsamt (BVA). This is an Excel-based tool that was developed specifically for large-scale public administration projects as part of the so-called S-O-S method. The aim of the tool is to record, evaluate, and document risks in a structured manner. It thus offers a practical template for project teams with complex projects.⁴²^,⁴³

The tool integrates classic risk assessment methods, including a detailed risk list with information on causes, probability of occurrence, extent of damage and possible countermeasures. In addition, a risk matrix is used to prioritize and visually represent project risks. The Excel-based tool makes it easier to adjust and take project-specific requirements into account. However, it should be noted that this tool was designed specifically for use in public administration and for large-scale projects and may therefore have limited usability outside this field of application.⁴²^,⁴³

The final example is a scientifically developed tool presented by Settembre-Blundo et al. (2021) that was created in the context of an academic research organization. The aim of this approach is to expand classic, often purely technical risk management methods to include a strategic and multidimensional perspective. This should enable companies to respond more flexibly and resiliently to uncertain conditions such as climate change. The tool is based on a multidimensional matrix that links risks at three levels with sustainability dimensions. By drawing on key principles of established frameworks such as ISO 31000 and COSO, it is compatible with existing standards. However, it is relatively complex to use and requires data collection based primarily on qualitative assessments by executives and managers.⁴⁴

Overall, the landscape of risk assessment tools spans a broad spectrum. It can be said that the choice of the right risk assessment tool depends crucially on the available resources, the industry focus and the specific requirements of an organization or company.

3 New tool/template

The Sustainability Risk Assessment Tool is an Excel-based tool for the systematic recording, assessment, and management of sustainability risks. The tool consists of several interconnected worksheets that consider key factors of modern sustainability risk management. The tool is based on the principles and assumptions of the COSO/WBCSD frameworks, which link enterprise risk management with ESG risks.⁴⁵ The tool thus provides a practical interface for extending the recognized COSO framework regarding sustainability issues.

3.1 Navigation

When opening the Sustainability Risk Assessment Tool, the user company is first taken to the “Navigation” page. This serves as a guide and is structured like a table of contents. Here, the company learns that the Excel tool consists of ten worksheets. Intuitive use is made possible by appropriate links to the individual modules.

3.2 Stakeholder analysis

The stakeholder analysis worksheet enables companies to identify relevant stakeholders and evaluate them based on various dimensions. For ease of use, the worksheet contains a brief explanation of the structure in the upper section, which is explained in more detail here.

The tool lists examples of classic stakeholder groups such as investors, customers, or suppliers, which can be supplemented with company-specific information.⁴⁶ In this worksheet, the company can assess the level of interest in ESG issues for each stakeholder. A scale from 1 to 5 is available for this purpose. This scale was also chosen for the subsequent survey of the stakeholders’ influence on the company. This creates uniformity and a simple understanding of how to use the tool. Based on the ESG interest level and the level of influence, it is then easier for the company to determine the priority for stakeholder involvement. Here, the tool distinguishes between very high, high, medium, and low priority. Users are then able to record relevant expectations or concerns of the stakeholders. To do this, they have a range of options available to him, which they can select with a click in the drop-down menu. The last two columns deal with communication: Based on previous selections, the company has a completed Excel spreadsheet and sees, among other things, the derived priority assigned to each stakeholder. This makes it easier for them to estimate how often they should or must contact the respective stakeholder. The company can note this frequency in the Excel spreadsheet by choosing weekly, quarterly, or semi-annual communication. The tool also allows the company to enter the date of the last contact. This creates clarity and practical relevance, as the large number of stakeholders often leads to a loss of overview in practice.

3.3 Materiality analysis

The company finds the materiality analysis on the subsequent worksheet, which is a useful tool to identify and prioritize the issues with the greatest economic, environmental, and social relevance.⁴⁷ Since the tool focuses on assessing and managing sustainability risks rather than on a comprehensive materiality analysis, this was presented in a very simplified form in the tool.⁴⁷ Since the tool focuses on assessing and managing sustainability risks rather than on a comprehensive materiality analysis, this was presented in a very simplified form in the tool. This also explains the note at the beginning of the worksheet that the tool can be used without restrictions even without the materiality analysis. In the columns “Business Relevance”, “Stakeholder Relevance” and “Regulatory Pressure”, the company enters a value between 1 and 5 (1 = low, 5 = high). These three values are then used to calculate the materiality score and corresponding materiality level, which provides users with a quick overview of the company’s most important sustainability issues. A corresponding automatically updated overview can be found on the dashboard.

3.4 Governance structure

Once the company has compiled its shortlist of key ESG risks, it can use the next sheet to develop an overview of its own governance structure. This is a kind of map of responsibilities for internal corporate sustainability risks. Such an overview ensures that ESG issues are structurally anchored in risk assessment, closes possible gaps in responsibility, and highlights unclear responsibilities.

3.5 ESG Risk assessment explanation sheet and further information for the ESG risk register

With this solid foundation, we can now begin the risk assessment. Companies will find an introduction sheet that provides an overview of the risk assessment process. To ensure a uniform understanding of the assessment scales, the columns of the risk assessment table are explained here, and the calculation logic is made transparent. The sheet is supplemented by another sheet called “Further Information for the ESG Risk Register”, which contains additional explanations and examples of the respective risk categories, megatrends, and corporate strategies required for assessing the risks.

In the ESG Risk Assessment, the company is asked at the outset to define its risk appetite threshold. Risk appetite describes the amount and type of risk a company is willing to consciously accept.⁴⁸ The threshold we have chosen is based on the principles of the COSO ERM framework.⁴⁸ The threshold we have chosen is based on the principles of the COSO ERM framework. COSO requires that a company’s risk appetite is determined before risk assessment. The framework deals with risks in a targeted and context-specific manner. Therefore, different thresholds must be set for different risk types (E, S, G). This is because each type of risk has fundamentally different impacts on the environment, society, and stakeholders. Therefore, stakeholder expectations are also included in the threshold. These have different risk tolerances depending on the type of risk.⁴⁵^,⁴⁹ These have different risk tolerances depending on the type of risk.⁴⁵^,⁴⁹

Based on the framework, it was assumed that the risk appetite threshold would reflect a more realistic value if the distinction among environmental, social, and governance risks were included in the calculation in quantified form. Therefore, a value has been specified for each of the three categories, which is already stored in the document. Environmental risks have a base value of 8. They often have a long-term time horizon. Therefore, stakeholders have a higher tolerance for the longer-term implementation of risk measures. Social risks, on the other hand, have a direct impact on society and an increased risk of immediate reputational damage. The base value for social risks is therefore.¹⁰ Governance risks have the highest base value at.¹² This is because a serious breach of trust by a company toward its stakeholders is often difficult to repair. Compliance issues often have a direct impact on investor withdrawal.¹ This is particularly dangerous for business. There is talk of a regulatory “zero tolerance” approach to compliance issues.⁵⁰ If the company decides to take a different approach when determining the base values, these can easily be adjusted in the gray fields.

Once the underlying values have been defined, the company begins collecting the risks. Under the process step “Risk identification”, an individual risk ID is assigned, the risk category is selected, an appropriate general description of the risk is selected from a drop-down menu, and the risk is described in more detail. Furthermore, the time horizon (short, medium, or long-term) until the expected occurrence of the risk is determined, possible interdependencies between the risks are listed, and an assignment to one of the global megatrends is made.

The next step is to begin the qualitative assessment of the risks that were previously collected. Since one of the basic approaches in the COSO framework and ERM is the holistic integration of risks into corporate management⁵¹, the company has the option here to select the strategic link of the risk. A distinction is made between leadership, excellence, and basic strategies. Furthermore, the company selects whether the stakeholder impact is low, medium, or high and how it assesses the company’s resilience to the respective risk (1 = low; 5 = high).

This is followed by a quantitative assessment of the risks. Here, the company is required to determine the financial impact of the risk. It should be noted that, in addition to direct and indirect costs, opportunity costs and possible damage to reputation should also be included in order to realistically reflect the impact of the risk. A color scale ranging from light red to dark red is used to highlight the risks that are particularly serious in financial terms. The probability of the risk occurring and the severity of the effects (1 = low; 5 = high) must also be determined.

The fourth step involves calculating the risk score. This is based on the probability of the risk occurring, the time horizon, and the impact severity. The score ranges from 1 to.²⁵ Values in the lower third are marked green, values in the middle third yellow, and values in the upper third red, making it clear which risks are in the critical range. The dashboard contains the corresponding risk heat map for simplified visualization. In the adjacent column, the company specifies the score it aims to achieve after implementing all measures. It is important that the target score is below the risk appetite threshold explained above, which is calculated in the adjacent column.

In the final step, the status of the risk can be updated regularly by selecting from a drop-down menu. This sheet is used to collect the company’s sustainability risks and evaluate, and correlate them, considering relevant factors based on the COSO/WBCSD framework.

After recording and assessing the risks, the tool offers the option of further planning, recording, and controlling appropriate measures. In the “ESG Action Plan”, the company has the option of developing one or more measures for each risk. For each risk, there is a column in the ESG Action Plan for each previously assessed risk. Here, the measures are described, responsibilities are defined, and the time frame for implementation and the corresponding budget are specified. Progress is tracked in a dynamic progress bar.

Furthermore, the tool offers the option to document the success and progress of the measures initiated by defining one or more KPIs for each measure, the development of which is documented via intermediate steps up to the target value.

The implementation of the measures is reflected in an improvement in the risk score. For this purpose, the company must determine the percentage improvement in risk it hopes to achieve after implementing the measure. The risk score is then automatically adjusted in relation to the progress made in implementing the measure. The improvement is shown in the “ESG Risk Assessment” in the “Current_Risk_Score_Measurement” column and in a corresponding figure on the dashboard.

3.6 Scenario analysis

In addition to the risk assessment already described, the next worksheet contains the scenario analysis. Consistent with the previous approach, this sheet is also introduced by an explanatory sheet that explains the process and breaks down assessment scales and calculations.

According to the COSO framework, defining various scenarios from best to worst case is recommended as a tool for further risk assessment.⁴⁵^,⁵² Four example climate scenarios are stored in the tool. These represent various combinations of probabilities of occurrence and degrees of impact for the previously recorded risks. The variation of assumptions in scenarios is helpful in making the range of possible future developments and their impact on the overall risk transparent. This method is particularly valuable for stakeholders, as it demonstrates the company’s resilience to various scenarios.

If the company decides not to use the pre-entered scenarios, the fields can simply be filled in again. It is important to assess both the probability of the scenario occurring as such and the probability of the associated risks occurring should the scenario occur. This supports a more differentiated assessment.

The scenario analysis process begins with scenario development: defining the scenarios, probability of occurrence, time horizon, and identification of key drivers. The next step is the qualitative and quantitative evaluation of the scenario, which includes determining the financial impact of the entire scenario and determining how difficult it would be for the company to adapt to the scenario. Here, you can choose between low, medium, high, and very high. In this case, very high would mean, for example, that the measures would be very challenging for the company and that emergency measures would have to be initiated.

The third step involves the strategic classification of the scenario. Here, key assumptions for the scenario are made. This ensures that every decision is transparent and can be traced back to the underlying considerations. Early warning indicators are also defined, and key business context drivers are established. Based on the classification, the response strategies are planned in the third step.

In the final step, advanced risk management, the scenarios are finally evaluated using the key figures “Risk Score”, Value at Risk 95%, and the threshold value for Value at Risk. This helps to ensure that well-founded decisions can be made about further possible actions and that the scenario can be appropriately considered in the business strategy.

3.7 Shortcomings and avenues for future work

Our Excel-based sustainability risk assessment tool provides a practical basis for analyzing and evaluating company-specific sustainability risks. To increase the decision-making capability and scalability of our tool, we see four areas for development:

The current dashboard aggregates risk scores but is limited in terms of depth and diagnostic capabilities. In the future, we would like to expand the dashboard to include KPI tiles and an action board. The tiles would show definitions, data sources, owners, and an update cycle. The action board would provide an overview of the top risks, stored actions, responsibilities, status, and due dates. Linking to the details would improve the manageability and transparency of the tool.

Currently, KPIs are based on manual entries. To improve measurement quality and timeliness, we would integrate external data sources. For supply chain risks, a link to the EcoVadis platform would be possible, or for updated emissions and intensity calculations, a connection to the Climatiq platform.

To map external shocks, we would expand the existing risk assessment to include stress tests. This would result in an assessment under stress conditions that would reveal possible threshold violations and further develop the snapshot into a more robust decision-making tool.

So far, the tool has been managed mostly manually, which makes it more sensitive to errors. By further automating the Excel-based tool, we would reduce the effort and error rate and highlight the tool’s benefits more.

References

1
State of the Global Climate 2024. World Meteorological Organization https://wmo.int/publication-series/state-of-global-climate-2024 (2025). ↩︎
2
Nachhaltigkeit (nachhaltige Entwicklung). Bundesministerium für wirtschaftliche Zusammenarbeit und Entwicklung https://www.bmz.de/de/service/lexikon/nachhaltigkeit-nachhaltige-entwicklung-14700. ↩︎
3
State of the Global Climate 2024. (United Nations, 2025). ↩︎
4
WMO report documents spiralling weather and climate impacts. World Meteorological Organization https://wmo.int/media/news/wmo-report-documents-spiralling-weather-and-climate-impacts (2025). ↩︎
3
State of the Global Climate 2024. (United Nations, 2025). ↩︎
3
State of the Global Climate 2024. (United Nations, 2025). ↩︎
3
State of the Global Climate 2024. (United Nations, 2025). ↩︎
3
State of the Global Climate 2024. (United Nations, 2025). ↩︎
5
Economic costs of weather-related disasters soars but early warnings save lives. World Meteorological Organization https://wmo.int/media/news/economic-costs-of-weather-related-disasters-soars-early-warnings-save-lives (2023). ↩︎
3
State of the Global Climate 2024. (United Nations, 2025). ↩︎
6
Will climate change make insurance too expensive? – DW – 06/23/2024. dw.com https://www.dw.com/en/will-climate-change-make-insurance-too-expensive/a-69439449. ↩︎
7
Bundesanstalt für Finanzdienstleistungsaufsicht. Merkblatt zum Umgang mit Nachhaltigkeitsrisiken. (2020). ↩︎
7
Bundesanstalt für Finanzdienstleistungsaufsicht. Merkblatt zum Umgang mit Nachhaltigkeitsrisiken. (2020). ↩︎
7
Bundesanstalt für Finanzdienstleistungsaufsicht. Merkblatt zum Umgang mit Nachhaltigkeitsrisiken. (2020). ↩︎
7
Bundesanstalt für Finanzdienstleistungsaufsicht. Merkblatt zum Umgang mit Nachhaltigkeitsrisiken. (2020). ↩︎
8
UNEP Finance Initiative and UN Global Compact. Managing ESG risks in the supply chains of private companies and assets. (2017). ↩︎
9
EU-Taxonomieverordnung. BaFin https://www.bafin.de/DE/Aufsicht/SF/TaxonomieVO/TaxanomieVO_node.html. ↩︎
10
Verordnung – 2020/852 – DE – taxonomie verordnung – EUR-Lex. https://eur-lex.europa.eu/eli/reg/2020/852/oj/deu. ↩︎
10
Verordnung – 2020/852 – DE – taxonomie verordnung – EUR-Lex. https://eur-lex.europa.eu/eli/reg/2020/852/oj/deu. ↩︎
7
Bundesanstalt für Finanzdienstleistungsaufsicht. Merkblatt zum Umgang mit Nachhaltigkeitsrisiken. (2020). ↩︎
8
UNEP Finance Initiative and UN Global Compact. Managing ESG risks in the supply chains of private companies and assets. (2017). ↩︎
7
Bundesanstalt für Finanzdienstleistungsaufsicht. Merkblatt zum Umgang mit Nachhaltigkeitsrisiken. (2020). ↩︎
7
Bundesanstalt für Finanzdienstleistungsaufsicht. Merkblatt zum Umgang mit Nachhaltigkeitsrisiken. (2020). ↩︎
7
Bundesanstalt für Finanzdienstleistungsaufsicht. Merkblatt zum Umgang mit Nachhaltigkeitsrisiken. (2020). ↩︎
11
Trotz Fortschritten: 138 Millionen Kinder von Kinderarbeit betroffen. https://www.unicef.de/informieren/aktuelles/presse/-/trotz-fortschritten-kinderarbeit-bleibt-fuer-138-millionen-kinder-weltweit-realitaet-/375886 (2025). ↩︎
11
Trotz Fortschritten: 138 Millionen Kinder von Kinderarbeit betroffen. https://www.unicef.de/informieren/aktuelles/presse/-/trotz-fortschritten-kinderarbeit-bleibt-fuer-138-millionen-kinder-weltweit-realitaet-/375886 (2025). ↩︎
12
Charbonneau, N. Kinderarbeit: Die wichtigsten Fragen & Antworten | UNICEF. https://www.unicef.de/informieren/aktuelles/blog/-/kinderarbeit-fragen-und-antworten/275272 (2025). ↩︎
12
Charbonneau, N. Kinderarbeit: Die wichtigsten Fragen & Antworten | UNICEF. https://www.unicef.de/informieren/aktuelles/blog/-/kinderarbeit-fragen-und-antworten/275272 (2025). ↩︎
12
Charbonneau, N. Kinderarbeit: Die wichtigsten Fragen & Antworten | UNICEF. https://www.unicef.de/informieren/aktuelles/blog/-/kinderarbeit-fragen-und-antworten/275272 (2025). ↩︎
13
Letorey, P., Gore, N., Osse, P. & Dragstra, F. Living Wage: An emerging standard. (2023). ↩︎
14
Wage trends: Bangladesh. Fair Labor Association https://www.fairlabor.org/resource/fair-labor-associations-bangladesh-wage-trends-report-and-recommendations/. ↩︎
15
Garment workers must receive rights-based compensation and justice immediately. Amnesty International https://www.amnesty.org/en/latest/news/2024/05/bangladesh-garment-workers-must-receive-rights-based-compensation-and-justice-immediately/ (2024). ↩︎
7
Bundesanstalt für Finanzdienstleistungsaufsicht. Merkblatt zum Umgang mit Nachhaltigkeitsrisiken. (2020). ↩︎
8
UNEP Finance Initiative and UN Global Compact. Managing ESG risks in the supply chains of private companies and assets. (2017). ↩︎
7
Bundesanstalt für Finanzdienstleistungsaufsicht. Merkblatt zum Umgang mit Nachhaltigkeitsrisiken. (2020). ↩︎
16
CSR – Corporate Sustainability Reporting Directive (CSRD). https://www.csr-in-deutschland.de/DE/CSR-Allgemein/CSR-Politik/CSR-in-der-EU/Corporate-Sustainability-Reporting-Directive/corporate-sustainability-reporting-directive-art.html. ↩︎
17
PricewaterhouseCoopers. 10 pitfalls companies should avoid when complying with the CSRD’s double materiality. PwC https://www.pwc.com/us/en/services/esg/library/csrd-double-materiality.html (2025). ↩︎
18
deutschlandfunk.de. Südafrika – Der schwierige Kampf gegen Korruption. Deutschlandfunk https://www.deutschlandfunk.de/suedafrika-der-schwierige-kampf-gegen-korruption-100.html (2021). ↩︎
19
Corporate sustainability due diligence – European Commission. https://commission.europa.eu/business-economy-euro/doing-business-eu/sustainability-due-diligence-responsible-business/corporate-sustainability-due-diligence_en. ↩︎
20
Klima, Lieferkette, Corona: Wie übernehmen deutsche Unternehmen Verantwortung? | Ranking-Ergebnisse vorgestellt. Ranking Nachhaltigkeitsberichte https://www.ranking-nachhaltigkeitsberichte.de/news-single/article/klima-lieferkette-corona-wie-uebernehmen-deutsche-unternehmen-verantwortung-ranking-ergebnisse-vorgestellt (2022). ↩︎
20
Klima, Lieferkette, Corona: Wie übernehmen deutsche Unternehmen Verantwortung? | Ranking-Ergebnisse vorgestellt. Ranking Nachhaltigkeitsberichte https://www.ranking-nachhaltigkeitsberichte.de/news-single/article/klima-lieferkette-corona-wie-uebernehmen-deutsche-unternehmen-verantwortung-ranking-ergebnisse-vorgestellt (2022). ↩︎
21
Romeike, F. Risikomanagement. vol. 1 (Springer Fachmedien Wiesbaden GmbH, Wiesbaden, 2018). ↩︎
21
Romeike, F. Risikomanagement. vol. 1 (Springer Fachmedien Wiesbaden GmbH, Wiesbaden, 2018). ↩︎
22
Duijm, N. J. Recommendations on the use and design of risk matrices. Saf. Sci. 76, 21–31 (2015). ↩︎
23
Markowski, A. S. & Mannan, M. S. Fuzzy risk matrix. Jounal Hardardous Mater. 159, 152157 (2008). ↩︎
24
Kovačević, N., Stojiljković, A. & Kovač, M. Application of the matrix approach in risk assessment. Oper. Res. Eng. Sci. Theory Appl. 2, 55–64 (2019). ↩︎
24
Kovačević, N., Stojiljković, A. & Kovač, M. Application of the matrix approach in risk assessment. Oper. Res. Eng. Sci. Theory Appl. 2, 55–64 (2019). ↩︎
25
Duinker, P. N. & Greig, L. A. Scenario analysis in environmental impact assessment: Improving explorations of the future. Environ. Impact Assess. Rev. 27, 206–219 (2007). ↩︎
26
Maack, J. N. Scenario analysis: a tool for task managers. Soc. Anal. Sel. Tools Tech. 62, (2001). ↩︎
27
Hoffmann, C. H. Strengths and Weaknesses of Scenario Planning as a Risk Management Tool. vol. Assessing Risk Assessment (Springer Gabler, Wiesbaden, 2017). ↩︎
28
Liu, H., Liu, L. & Liu, N. Risk evaluation approaches in failure mode and effects analysisi: A literature review. Expert Syst. Appl. 40, 828–838 (2013). ↩︎
29
Sandle, T. Approaching Risk Assessment: Tools and Methods. 1 Biopharmaceutical Resources Inc. Newsletter., 1–23 (2012). ↩︎
30
Najwa, N., Subriadi, A., Okfalisa, Saputra, E. & Furqon, M. The FMEA Traditional Modifications (FMEA Improvement) in IT Risk Assessment. Int. Appl. Bus. Eng. Conf. 2021 (2021). ↩︎
29
Sandle, T. Approaching Risk Assessment: Tools and Methods. 1 Biopharmaceutical Resources Inc. Newsletter., 1–23 (2012). ↩︎
31
Chen, B., Wu, Z. & Zhao, R. From fiction to fact. J. Chin. Econ. Bus. Stud. 21, 471–496 (2023). ↩︎
32
Harris, P. D. IDC MarketScape: Worldwide Governance, Risk and Compliance Software Vendor Assessment. (2025). ↩︎
32
Harris, P. D. IDC MarketScape: Worldwide Governance, Risk and Compliance Software Vendor Assessment. (2025). ↩︎
33
Steinmetz, M. Diligent Named a Leader in IDC MarketScape 2025 Worldwide GRC Software Report. Diligent https://www.diligent.com/company/newsroom/diligent-named-leader-in-idc-marketscape-2025-report (2025). ↩︎
34
Diligent One Platform Bewertungen & Produktdetails. g2 https://www.g2.com/products/diligent-one-platform/reviews?source=search. ↩︎
32
Harris, P. D. IDC MarketScape: Worldwide Governance, Risk and Compliance Software Vendor Assessment. (2025). ↩︎
35
OneTrust is named a leader in the IDC MarketScape 2025 Worldwide GRC Software Report. onetrust https://www.onetrust.com/news/onetrust-is-named-a-leader-in-the-idc-marketscape-2025-worldwide-grc-software-report/?utm_source=chatgpt.com (2025). ↩︎
36
OneTrust Privacy Automation Vor- und Nachteile: Top 5 Vorteile und Nachteile. g2 https://www.g2.com/products/onetrust-privacy-automation/reviews?qs=pros-and-cons. ↩︎
32
Harris, P. D. IDC MarketScape: Worldwide Governance, Risk and Compliance Software Vendor Assessment. (2025). ↩︎
37
Delaure, C. & Kumar, S. IBM wurde im IDC MarketScape: Worldwide GRC Software 2025 Vendor Assessment als Leader ausgezeichnet. IBM https://www.ibm.com/de-de/new/announcements/ibm-recognized-as-a-leader-in-idc-marketscape-worldwide-grc-software-2025-vendor-assessment (2025). ↩︎
37
Delaure, C. & Kumar, S. IBM wurde im IDC MarketScape: Worldwide GRC Software 2025 Vendor Assessment als Leader ausgezeichnet. IBM https://www.ibm.com/de-de/new/announcements/ibm-recognized-as-a-leader-in-idc-marketscape-worldwide-grc-software-2025-vendor-assessment (2025). ↩︎
38
IBM OpenPages Vor- und Nachteile: Top 5 Vorteile und Nachteile. g2 https://www.g2.com/products/ibm-openpages/reviews?qs=pros-and-cons. ↩︎
39
Prevalent Inc. The 2024 Prevalent Third-Party Risk Management Study. (2024). ↩︎
39
Prevalent Inc. The 2024 Prevalent Third-Party Risk Management Study. (2024). ↩︎
40
giz, D. G. für I. Z. (GIZ) G. Programm zur Stärkung einer nachhaltigkeitsorientierten Unternehmensfinanzierung. git https://www.giz.de/de/projekte/programm-zur-staerkung-einer-nachhaltigkeitsorientierten-unternehmensfinanzierung. ↩︎
41
giz, D. G. für I. Z. (GIZ) G. Journal of responsible finance, Knowlegde Series on Emerging Trends. 59–67 (2017). ↩︎
40
giz, D. G. für I. Z. (GIZ) G. Programm zur Stärkung einer nachhaltigkeitsorientierten Unternehmensfinanzierung. git https://www.giz.de/de/projekte/programm-zur-staerkung-einer-nachhaltigkeitsorientierten-unternehmensfinanzierung. ↩︎
41
giz, D. G. für I. Z. (GIZ) G. Journal of responsible finance, Knowlegde Series on Emerging Trends. 59–67 (2017). ↩︎
42
Bundesverwaltungsamt. Risikomanagement. https://www.bva.bund.de/DE/Services/Behoerden/Beratung/BZB/Themenwelten/Strategie/Projektmanagement/Wissenspool/S-O-S-Methode/stda_sos-kap8_risikomgmt.html (2025). ↩︎
43
Bundesverwaltungsamt. Risikomanagement Tool. (2020). ↩︎
42
Bundesverwaltungsamt. Risikomanagement. https://www.bva.bund.de/DE/Services/Behoerden/Beratung/BZB/Themenwelten/Strategie/Projektmanagement/Wissenspool/S-O-S-Methode/stda_sos-kap8_risikomgmt.html (2025). ↩︎
43
Bundesverwaltungsamt. Risikomanagement Tool. (2020). ↩︎
44
Settembre-Blund, D., Gonzáez-Sánchez, R., Medina-Salgado, S. & García-Muiña, F. E. Flexibility and Resilience in Corporate Decision Making: A New Sustain. Glob. J. Flex. Syst. Manag. 22, 107–132 (2021). ↩︎
45
COSO & wbcsd. Enterprise Risk Management, Appliying Enterprise Risk Management to Environmental, Social and Governance-Related Risks. https://docs.wbcsd.org/2018/10/COSO_WBCSD_ESGERM_Guidance.pdf (2018). ↩︎
46
Davis, K. Different stakeholder groups and their perceptions of project success. Int. J. Proj. Manag. 32, 189–201 (2014). ↩︎
47
Padilla-Garrido, N. et al. Materiality analysis in sustainability reporting: Insights from large Spanish companies. Corp. Soc. Responsib. Environ. Manag. 31, 5391–5412 (2024). ↩︎
47
Padilla-Garrido, N. et al. Materiality analysis in sustainability reporting: Insights from large Spanish companies. Corp. Soc. Responsib. Environ. Manag. 31, 5391–5412 (2024). ↩︎
48
Risk appetite and tolerance: guidance for practitioners. https://www.theirm.org/resources/find-a-resource/risk-appetite-and-tolerance-guidance-for-practitioners/. ↩︎
48
Risk appetite and tolerance: guidance for practitioners. https://www.theirm.org/resources/find-a-resource/risk-appetite-and-tolerance-guidance-for-practitioners/. ↩︎
45
COSO & wbcsd. Enterprise Risk Management, Appliying Enterprise Risk Management to Environmental, Social and Governance-Related Risks. https://docs.wbcsd.org/2018/10/COSO_WBCSD_ESGERM_Guidance.pdf (2018). ↩︎
49
Committee of Sponsoring Organizations of the Treadway Commissions & World Business Council for Sustainable Development. Enterprise Risk Management: Applying enterprise risk management to environmental, social and governance-related risks. (2018). ↩︎
45
COSO & wbcsd. Enterprise Risk Management, Appliying Enterprise Risk Management to Environmental, Social and Governance-Related Risks. https://docs.wbcsd.org/2018/10/COSO_WBCSD_ESGERM_Guidance.pdf (2018). ↩︎
49
Committee of Sponsoring Organizations of the Treadway Commissions & World Business Council for Sustainable Development. Enterprise Risk Management: Applying enterprise risk management to environmental, social and governance-related risks. (2018). ↩︎
10
Verordnung – 2020/852 – DE – taxonomie verordnung – EUR-Lex. https://eur-lex.europa.eu/eli/reg/2020/852/oj/deu. ↩︎
12
Charbonneau, N. Kinderarbeit: Die wichtigsten Fragen & Antworten | UNICEF. https://www.unicef.de/informieren/aktuelles/blog/-/kinderarbeit-fragen-und-antworten/275272 (2025). ↩︎
1
State of the Global Climate 2024. World Meteorological Organization https://wmo.int/publication-series/state-of-global-climate-2024 (2025). ↩︎
50
European Commission. Background document 2: A zero tolerance approach to non-compliance. (2021). ↩︎
51
Enterprise Risk Management. COSO https://www.coso.org/guidance-erm. ↩︎
25
Duinker, P. N. & Greig, L. A. Scenario analysis in environmental impact assessment: Improving explorations of the future. Environ. Impact Assess. Rev. 27, 206–219 (2007). ↩︎
45
COSO & wbcsd. Enterprise Risk Management, Appliying Enterprise Risk Management to Environmental, Social and Governance-Related Risks. https://docs.wbcsd.org/2018/10/COSO_WBCSD_ESGERM_Guidance.pdf (2018). ↩︎
52
McBride, E. P. Enterprise Risk Management: Framework Presence and Effectiveness. ↩︎

1
State of the Global Climate 2024. World Meteorological Organization https://wmo.int/publication-series/state-of-global-climate-2024 (2025). ↩︎
2
Nachhaltigkeit (nachhaltige Entwicklung). Bundesministerium für wirtschaftliche Zusammenarbeit und Entwicklung https://www.bmz.de/de/service/lexikon/nachhaltigkeit-nachhaltige-entwicklung-14700. ↩︎
3
State of the Global Climate 2024. (United Nations, 2025). ↩︎
4
WMO report documents spiralling weather and climate impacts. World Meteorological Organization https://wmo.int/media/news/wmo-report-documents-spiralling-weather-and-climate-impacts (2025). ↩︎
3
State of the Global Climate 2024. (United Nations, 2025). ↩︎
3
State of the Global Climate 2024. (United Nations, 2025). ↩︎
3
State of the Global Climate 2024. (United Nations, 2025). ↩︎
3
State of the Global Climate 2024. (United Nations, 2025). ↩︎
5
Economic costs of weather-related disasters soars but early warnings save lives. World Meteorological Organization https://wmo.int/media/news/economic-costs-of-weather-related-disasters-soars-early-warnings-save-lives (2023). ↩︎
3
State of the Global Climate 2024. (United Nations, 2025). ↩︎
6
Will climate change make insurance too expensive? – DW – 06/23/2024. dw.com https://www.dw.com/en/will-climate-change-make-insurance-too-expensive/a-69439449. ↩︎
7
Bundesanstalt für Finanzdienstleistungsaufsicht. Merkblatt zum Umgang mit Nachhaltigkeitsrisiken. (2020). ↩︎
7
Bundesanstalt für Finanzdienstleistungsaufsicht. Merkblatt zum Umgang mit Nachhaltigkeitsrisiken. (2020). ↩︎
7
Bundesanstalt für Finanzdienstleistungsaufsicht. Merkblatt zum Umgang mit Nachhaltigkeitsrisiken. (2020). ↩︎
7
Bundesanstalt für Finanzdienstleistungsaufsicht. Merkblatt zum Umgang mit Nachhaltigkeitsrisiken. (2020). ↩︎
8
UNEP Finance Initiative and UN Global Compact. Managing ESG risks in the supply chains of private companies and assets. (2017). ↩︎
9
EU-Taxonomieverordnung. BaFin https://www.bafin.de/DE/Aufsicht/SF/TaxonomieVO/TaxanomieVO_node.html. ↩︎
10
Verordnung – 2020/852 – DE – taxonomie verordnung – EUR-Lex. https://eur-lex.europa.eu/eli/reg/2020/852/oj/deu. ↩︎
10
Verordnung – 2020/852 – DE – taxonomie verordnung – EUR-Lex. https://eur-lex.europa.eu/eli/reg/2020/852/oj/deu. ↩︎
7
Bundesanstalt für Finanzdienstleistungsaufsicht. Merkblatt zum Umgang mit Nachhaltigkeitsrisiken. (2020). ↩︎
8
UNEP Finance Initiative and UN Global Compact. Managing ESG risks in the supply chains of private companies and assets. (2017). ↩︎
7
Bundesanstalt für Finanzdienstleistungsaufsicht. Merkblatt zum Umgang mit Nachhaltigkeitsrisiken. (2020). ↩︎
7
Bundesanstalt für Finanzdienstleistungsaufsicht. Merkblatt zum Umgang mit Nachhaltigkeitsrisiken. (2020). ↩︎
7
Bundesanstalt für Finanzdienstleistungsaufsicht. Merkblatt zum Umgang mit Nachhaltigkeitsrisiken. (2020). ↩︎
11
Trotz Fortschritten: 138 Millionen Kinder von Kinderarbeit betroffen. https://www.unicef.de/informieren/aktuelles/presse/-/trotz-fortschritten-kinderarbeit-bleibt-fuer-138-millionen-kinder-weltweit-realitaet-/375886 (2025). ↩︎
11
Trotz Fortschritten: 138 Millionen Kinder von Kinderarbeit betroffen. https://www.unicef.de/informieren/aktuelles/presse/-/trotz-fortschritten-kinderarbeit-bleibt-fuer-138-millionen-kinder-weltweit-realitaet-/375886 (2025). ↩︎
12
Charbonneau, N. Kinderarbeit: Die wichtigsten Fragen & Antworten | UNICEF. https://www.unicef.de/informieren/aktuelles/blog/-/kinderarbeit-fragen-und-antworten/275272 (2025). ↩︎
12
Charbonneau, N. Kinderarbeit: Die wichtigsten Fragen & Antworten | UNICEF. https://www.unicef.de/informieren/aktuelles/blog/-/kinderarbeit-fragen-und-antworten/275272 (2025). ↩︎
12
Charbonneau, N. Kinderarbeit: Die wichtigsten Fragen & Antworten | UNICEF. https://www.unicef.de/informieren/aktuelles/blog/-/kinderarbeit-fragen-und-antworten/275272 (2025). ↩︎
13
Letorey, P., Gore, N., Osse, P. & Dragstra, F. Living Wage: An emerging standard. (2023). ↩︎
14
Wage trends: Bangladesh. Fair Labor Association https://www.fairlabor.org/resource/fair-labor-associations-bangladesh-wage-trends-report-and-recommendations/. ↩︎
15
Garment workers must receive rights-based compensation and justice immediately. Amnesty International https://www.amnesty.org/en/latest/news/2024/05/bangladesh-garment-workers-must-receive-rights-based-compensation-and-justice-immediately/ (2024). ↩︎
7
Bundesanstalt für Finanzdienstleistungsaufsicht. Merkblatt zum Umgang mit Nachhaltigkeitsrisiken. (2020). ↩︎
8
UNEP Finance Initiative and UN Global Compact. Managing ESG risks in the supply chains of private companies and assets. (2017). ↩︎
7
Bundesanstalt für Finanzdienstleistungsaufsicht. Merkblatt zum Umgang mit Nachhaltigkeitsrisiken. (2020). ↩︎
16
CSR – Corporate Sustainability Reporting Directive (CSRD). https://www.csr-in-deutschland.de/DE/CSR-Allgemein/CSR-Politik/CSR-in-der-EU/Corporate-Sustainability-Reporting-Directive/corporate-sustainability-reporting-directive-art.html. ↩︎
17
PricewaterhouseCoopers. 10 pitfalls companies should avoid when complying with the CSRD’s double materiality. PwC https://www.pwc.com/us/en/services/esg/library/csrd-double-materiality.html (2025). ↩︎
18
deutschlandfunk.de. Südafrika – Der schwierige Kampf gegen Korruption. Deutschlandfunk https://www.deutschlandfunk.de/suedafrika-der-schwierige-kampf-gegen-korruption-100.html (2021). ↩︎
19
Corporate sustainability due diligence – European Commission. https://commission.europa.eu/business-economy-euro/doing-business-eu/sustainability-due-diligence-responsible-business/corporate-sustainability-due-diligence_en. ↩︎
20
Klima, Lieferkette, Corona: Wie übernehmen deutsche Unternehmen Verantwortung? | Ranking-Ergebnisse vorgestellt. Ranking Nachhaltigkeitsberichte https://www.ranking-nachhaltigkeitsberichte.de/news-single/article/klima-lieferkette-corona-wie-uebernehmen-deutsche-unternehmen-verantwortung-ranking-ergebnisse-vorgestellt (2022). ↩︎
20
Klima, Lieferkette, Corona: Wie übernehmen deutsche Unternehmen Verantwortung? | Ranking-Ergebnisse vorgestellt. Ranking Nachhaltigkeitsberichte https://www.ranking-nachhaltigkeitsberichte.de/news-single/article/klima-lieferkette-corona-wie-uebernehmen-deutsche-unternehmen-verantwortung-ranking-ergebnisse-vorgestellt (2022). ↩︎
21
Romeike, F. Risikomanagement. vol. 1 (Springer Fachmedien Wiesbaden GmbH, Wiesbaden, 2018). ↩︎
21
Romeike, F. Risikomanagement. vol. 1 (Springer Fachmedien Wiesbaden GmbH, Wiesbaden, 2018). ↩︎
22
Duijm, N. J. Recommendations on the use and design of risk matrices. Saf. Sci. 76, 21–31 (2015). ↩︎
23
Markowski, A. S. & Mannan, M. S. Fuzzy risk matrix. Jounal Hardardous Mater. 159, 152157 (2008). ↩︎
24
Kovačević, N., Stojiljković, A. & Kovač, M. Application of the matrix approach in risk assessment. Oper. Res. Eng. Sci. Theory Appl. 2, 55–64 (2019). ↩︎
24
Kovačević, N., Stojiljković, A. & Kovač, M. Application of the matrix approach in risk assessment. Oper. Res. Eng. Sci. Theory Appl. 2, 55–64 (2019). ↩︎
25
Duinker, P. N. & Greig, L. A. Scenario analysis in environmental impact assessment: Improving explorations of the future. Environ. Impact Assess. Rev. 27, 206–219 (2007). ↩︎
26
Maack, J. N. Scenario analysis: a tool for task managers. Soc. Anal. Sel. Tools Tech. 62, (2001). ↩︎
27
Hoffmann, C. H. Strengths and Weaknesses of Scenario Planning as a Risk Management Tool. vol. Assessing Risk Assessment (Springer Gabler, Wiesbaden, 2017). ↩︎
28
Liu, H., Liu, L. & Liu, N. Risk evaluation approaches in failure mode and effects analysisi: A literature review. Expert Syst. Appl. 40, 828–838 (2013). ↩︎
29
Sandle, T. Approaching Risk Assessment: Tools and Methods. 1 Biopharmaceutical Resources Inc. Newsletter., 1–23 (2012). ↩︎
30
Najwa, N., Subriadi, A., Okfalisa, Saputra, E. & Furqon, M. The FMEA Traditional Modifications (FMEA Improvement) in IT Risk Assessment. Int. Appl. Bus. Eng. Conf. 2021 (2021). ↩︎
29
Sandle, T. Approaching Risk Assessment: Tools and Methods. 1 Biopharmaceutical Resources Inc. Newsletter., 1–23 (2012). ↩︎
31
Chen, B., Wu, Z. & Zhao, R. From fiction to fact. J. Chin. Econ. Bus. Stud. 21, 471–496 (2023). ↩︎
32
Harris, P. D. IDC MarketScape: Worldwide Governance, Risk and Compliance Software Vendor Assessment. (2025). ↩︎
32
Harris, P. D. IDC MarketScape: Worldwide Governance, Risk and Compliance Software Vendor Assessment. (2025). ↩︎
33
Steinmetz, M. Diligent Named a Leader in IDC MarketScape 2025 Worldwide GRC Software Report. Diligent https://www.diligent.com/company/newsroom/diligent-named-leader-in-idc-marketscape-2025-report (2025). ↩︎
34
Diligent One Platform Bewertungen & Produktdetails. g2 https://www.g2.com/products/diligent-one-platform/reviews?source=search. ↩︎
32
Harris, P. D. IDC MarketScape: Worldwide Governance, Risk and Compliance Software Vendor Assessment. (2025). ↩︎
35
OneTrust is named a leader in the IDC MarketScape 2025 Worldwide GRC Software Report. onetrust https://www.onetrust.com/news/onetrust-is-named-a-leader-in-the-idc-marketscape-2025-worldwide-grc-software-report/?utm_source=chatgpt.com (2025). ↩︎
36
OneTrust Privacy Automation Vor- und Nachteile: Top 5 Vorteile und Nachteile. g2 https://www.g2.com/products/onetrust-privacy-automation/reviews?qs=pros-and-cons. ↩︎
32
Harris, P. D. IDC MarketScape: Worldwide Governance, Risk and Compliance Software Vendor Assessment. (2025). ↩︎
37
Delaure, C. & Kumar, S. IBM wurde im IDC MarketScape: Worldwide GRC Software 2025 Vendor Assessment als Leader ausgezeichnet. IBM https://www.ibm.com/de-de/new/announcements/ibm-recognized-as-a-leader-in-idc-marketscape-worldwide-grc-software-2025-vendor-assessment (2025). ↩︎
37
Delaure, C. & Kumar, S. IBM wurde im IDC MarketScape: Worldwide GRC Software 2025 Vendor Assessment als Leader ausgezeichnet. IBM https://www.ibm.com/de-de/new/announcements/ibm-recognized-as-a-leader-in-idc-marketscape-worldwide-grc-software-2025-vendor-assessment (2025). ↩︎
38
IBM OpenPages Vor- und Nachteile: Top 5 Vorteile und Nachteile. g2 https://www.g2.com/products/ibm-openpages/reviews?qs=pros-and-cons. ↩︎
39
Prevalent Inc. The 2024 Prevalent Third-Party Risk Management Study. (2024). ↩︎
39
Prevalent Inc. The 2024 Prevalent Third-Party Risk Management Study. (2024). ↩︎
40
giz, D. G. für I. Z. (GIZ) G. Programm zur Stärkung einer nachhaltigkeitsorientierten Unternehmensfinanzierung. git https://www.giz.de/de/projekte/programm-zur-staerkung-einer-nachhaltigkeitsorientierten-unternehmensfinanzierung. ↩︎
41
giz, D. G. für I. Z. (GIZ) G. Journal of responsible finance, Knowlegde Series on Emerging Trends. 59–67 (2017). ↩︎
40
giz, D. G. für I. Z. (GIZ) G. Programm zur Stärkung einer nachhaltigkeitsorientierten Unternehmensfinanzierung. git https://www.giz.de/de/projekte/programm-zur-staerkung-einer-nachhaltigkeitsorientierten-unternehmensfinanzierung. ↩︎
41
giz, D. G. für I. Z. (GIZ) G. Journal of responsible finance, Knowlegde Series on Emerging Trends. 59–67 (2017). ↩︎
42
Bundesverwaltungsamt. Risikomanagement. https://www.bva.bund.de/DE/Services/Behoerden/Beratung/BZB/Themenwelten/Strategie/Projektmanagement/Wissenspool/S-O-S-Methode/stda_sos-kap8_risikomgmt.html (2025). ↩︎
43
Bundesverwaltungsamt. Risikomanagement Tool. (2020). ↩︎
42
Bundesverwaltungsamt. Risikomanagement. https://www.bva.bund.de/DE/Services/Behoerden/Beratung/BZB/Themenwelten/Strategie/Projektmanagement/Wissenspool/S-O-S-Methode/stda_sos-kap8_risikomgmt.html (2025). ↩︎
43
Bundesverwaltungsamt. Risikomanagement Tool. (2020). ↩︎
44
Settembre-Blund, D., Gonzáez-Sánchez, R., Medina-Salgado, S. & García-Muiña, F. E. Flexibility and Resilience in Corporate Decision Making: A New Sustain. Glob. J. Flex. Syst. Manag. 22, 107–132 (2021). ↩︎
45
COSO & wbcsd. Enterprise Risk Management, Appliying Enterprise Risk Management to Environmental, Social and Governance-Related Risks. https://docs.wbcsd.org/2018/10/COSO_WBCSD_ESGERM_Guidance.pdf (2018). ↩︎
46
Davis, K. Different stakeholder groups and their perceptions of project success. Int. J. Proj. Manag. 32, 189–201 (2014). ↩︎
47
Padilla-Garrido, N. et al. Materiality analysis in sustainability reporting: Insights from large Spanish companies. Corp. Soc. Responsib. Environ. Manag. 31, 5391–5412 (2024). ↩︎
47
Padilla-Garrido, N. et al. Materiality analysis in sustainability reporting: Insights from large Spanish companies. Corp. Soc. Responsib. Environ. Manag. 31, 5391–5412 (2024). ↩︎
48
Risk appetite and tolerance: guidance for practitioners. https://www.theirm.org/resources/find-a-resource/risk-appetite-and-tolerance-guidance-for-practitioners/. ↩︎
48
Risk appetite and tolerance: guidance for practitioners. https://www.theirm.org/resources/find-a-resource/risk-appetite-and-tolerance-guidance-for-practitioners/. ↩︎
45
COSO & wbcsd. Enterprise Risk Management, Appliying Enterprise Risk Management to Environmental, Social and Governance-Related Risks. https://docs.wbcsd.org/2018/10/COSO_WBCSD_ESGERM_Guidance.pdf (2018). ↩︎
49
Committee of Sponsoring Organizations of the Treadway Commissions & World Business Council for Sustainable Development. Enterprise Risk Management: Applying enterprise risk management to environmental, social and governance-related risks. (2018). ↩︎
45
COSO & wbcsd. Enterprise Risk Management, Appliying Enterprise Risk Management to Environmental, Social and Governance-Related Risks. https://docs.wbcsd.org/2018/10/COSO_WBCSD_ESGERM_Guidance.pdf (2018). ↩︎
49
Committee of Sponsoring Organizations of the Treadway Commissions & World Business Council for Sustainable Development. Enterprise Risk Management: Applying enterprise risk management to environmental, social and governance-related risks. (2018). ↩︎
10
Verordnung – 2020/852 – DE – taxonomie verordnung – EUR-Lex. https://eur-lex.europa.eu/eli/reg/2020/852/oj/deu. ↩︎
12
Charbonneau, N. Kinderarbeit: Die wichtigsten Fragen & Antworten | UNICEF. https://www.unicef.de/informieren/aktuelles/blog/-/kinderarbeit-fragen-und-antworten/275272 (2025). ↩︎
1
State of the Global Climate 2024. World Meteorological Organization https://wmo.int/publication-series/state-of-global-climate-2024 (2025). ↩︎
50
European Commission. Background document 2: A zero tolerance approach to non-compliance. (2021). ↩︎
51
Enterprise Risk Management. COSO https://www.coso.org/guidance-erm. ↩︎
25
Duinker, P. N. & Greig, L. A. Scenario analysis in environmental impact assessment: Improving explorations of the future. Environ. Impact Assess. Rev. 27, 206–219 (2007). ↩︎
45
COSO & wbcsd. Enterprise Risk Management, Appliying Enterprise Risk Management to Environmental, Social and Governance-Related Risks. https://docs.wbcsd.org/2018/10/COSO_WBCSD_ESGERM_Guidance.pdf (2018). ↩︎
52
McBride, E. P. Enterprise Risk Management: Framework Presence and Effectiveness. ↩︎