Operational risk management asks one question: what breaks? It inventories hazards, scores likelihood against impact, assigns controls, and plans for the day the control fails. That discipline is necessary. It is not the whole of risk management, and for a growing class of exposures it is not even the main part.
Governance risk management asks three different questions. What are we exposed to? — exposure the business has already taken on through its assets, markets, and public statements, whether or not anyone has scored it. What do we owe? — duties imposed from outside, by statute, regulation, contract, and listing rule, each with thresholds, dates, and a signature at the bottom. And who decides? — because when the risk is slow-moving, priced by other people, and disclosed in public, the decisions that matter are capital allocation, strategy, and disclosure, and those belong to the board.
When the risks are ESG-shaped and the duties are compliance-shaped, risk management stops being a departmental function and becomes a governance function. This page is that version. For the operational read of ESG risk itself — what it means for a mid-size company’s day-to-day exposures — see ESG Risk, Explained. What follows is the layer above it: the same exposures, handled as matters of oversight and obligation.
The ESG risk families, stated as governance objects
Transition risk is the exposure created by other people’s decisions: carbon pricing, border adjustments such as the EU’s CBAM, technology substitution, shifting customer mandates. It reprices assets and order books before it interrupts a single operation, which is why it is a governance object — the available responses are strategic (exit, convert, reprice, disclose), not operational.
Physical risk — flood, heat, water scarcity, storm — is operational at the point of impact, but governance in its timing. The horizons run past management tenure and past most planning cycles; the load-bearing decisions are where to site, what to harden, and what to insure or walk away from, taken years before the event.
Liability and litigation risk is the family boards most often underweight. Greenwashing claims, disclosure liability, and directors’-duties arguments share one feature: the exposure is created by the company’s own statements. A sustainability claim that outruns the underlying data is not a communications problem; it is a contingent liability drafted by the marketing department.
Disclosure risk is the newest family and the least intuitive. Once a company reports under a framework, the report itself becomes a risk surface: numbers that cannot be traced to a control, estimates presented as measurements, inconsistency between the sustainability statement and the financial statements. Assurance failure and restatement sit here — events that damage credibility with regulators and investors long after the operational facts are fixed.
None of these four is managed at the point of failure. All four are managed at the point of decision, which is the definition of a governance object.
The compliance-duty layer: where exposure becomes obligation
Exposure is a judgement; a duty is a fact. The compliance layer is where ESG risk acquires thresholds, deadlines, and named accountable officers — and it is currently moving in opposite directions on different sides of the Atlantic, which is itself a governance problem.
The EU: double materiality as a risk process. Under the CSRD as amended by the Omnibus I directive (in force March 2026), mandatory sustainability reporting now applies to undertakings with more than 1,000 employees and more than €450 million in net turnover, with first reports covering financial year 2027 and published in 2028. The scope narrowed; the method did not. The double materiality assessment — testing each topic for impact materiality (the company’s effects on people and environment) and financial materiality (the topic’s effects on the company) — remains the gateway, and it is, in substance, a board-level risk assessment with an audit trail. Boards that treat it as a reporting exercise miss what it is: the documented process by which the company decided what its material risks are. BC ESG’s CSRD double materiality implementation guide works through the mechanics for a real-estate portfolio.
California: one duty live, one duty paused. SB 253 requires US companies with more than $1 billion in revenue doing business in California to report Scope 1 and 2 emissions, with first reports due November 10, 2026 and Scope 3 following on CARB’s schedule. It is live and enforceable. Its sibling, SB 261 — biennial climate-related financial risk reports for companies above $500 million — has been under a Ninth Circuit injunction since November 2025, with no enforcement date currently set. Same legislature, same subject matter, opposite legal status: a board register that tracks topics rather than legal status will get at least one of these wrong. The full mechanics are in the California climate disclosure playbook.
The SEC: a withdrawn rule is not a withdrawn duty. The SEC’s 2024 climate disclosure rules never took effect — stayed in April 2024, undefended from March 2025, and formally proposed for rescission on May 29, 2026, with the rescission not yet final. The operative federal frame is therefore the older one: the Commission’s 2010 interpretive guidance on climate disclosure and the general materiality doctrine. The governance lesson generalises. The absence of a specific rule removes a checklist; it does not remove the liability that attaches to material misstatements, and it does not stop lenders, insurers, and customers from asking the same questions contractually.
The governance machinery
Machinery is what separates a governance treatment from a slide deck. Four components do most of the work.
Named board ownership. A committee charter — audit, risk, or a dedicated sustainability committee — names ESG and climate risk explicitly, with a reporting line and a calendar. Risk that belongs to every committee belongs to none, and “the full board oversees ESG” usually means no director has read the register.
A board-level risk register. Not the operational register rolled up, but a shorter, larger document: each entry carries an owner, a time horizon, a velocity (how fast it can crystallise), and — the field most registers omit — the decision it forces and the date by which that decision must be taken. A register entry that forces no decision is commentary.
The three lines, kept honest. In the IIA’s model, management owns the risk (first line), risk and compliance functions set method and challenge (second line), and internal audit provides independent assurance (third line). ESG reporting failures are disproportionately second-line failures: the number was compiled by the first line, published on schedule, and challenged by no one with the standing to stop it. Governance means the challenge function exists before publication, not after restatement.
Pay linkage, with its own risk controls. Where ESG metrics enter executive compensation, the risk process acquires an enforcement mechanism — and a new exposure, because a badly specified metric will be optimised exactly as written. The verification-before-payout discipline matters as much as the weighting; BC ESG’s board oversight and ESG-linked pay blueprint sets out the architecture, and KPI design covers how the metrics themselves should be built. Underneath all of it sits the inventory: governance decisions are only as good as the emissions data beneath them, which is why the one rule that sorts Scope 1, 2 and 3 is a governance topic and not merely an accounting one.
The operational sibling — and where the line sits
None of this replaces operational risk management. Hazard identification, control design, incident response, continuity planning: when the question is what breaks and how the business keeps running, the operational discipline is the answer, and Continuity Hub’s risk management anchor, in plain English, is the companion treatment of exactly that layer. The governance version begins where operations ends — with exposure the business has already chosen, duties it already owes, and decisions only the board can make. Organisations get into trouble when they run one of these disciplines and call it the other: a beautiful operational register with no board sight of the disclosure duty, or a board pack full of exposure with no controls underneath it.
What good looks like
- A committee charter names ESG and climate risk explicitly, with a reporting calendar the board actually keeps.
- The double materiality assessment is dated, minuted, and refreshed on a set cycle — filed as the risk decision it is, not as reporting paperwork.
- Every published ESG number traces to a named owner and a control, and the second line has challenged it before publication.
- The register records legal status per duty — live, stayed, proposed, rescinded — not just the topic.
- Pay-linked ESG metrics are verified before they pay out, and the clawback route is written down in advance.
- The board sees the same register management sees. A summary of a summary is not oversight.
The governance version of risk management is slower and less visible than the operational one. It produces fewer binders and more decisions. It is also where the liability sits — which is why, for ESG-shaped risks and compliance-shaped duties, it is the version the board has to own.