A climate risk assessment is frequently approached as a compliance task: commission a study, file it and return to business. Treated that way it produces a document and little else. Treated as a working process, with a defined purpose and a clear line to decisions, it shows where an organisation is exposed and what to do about it. The steps below set out how a business can carry one out in a way that leads to action.
Step One: Define Scope and Purpose
Begin with the decision the assessment must support. A lender reviewing a loan book, a manufacturer planning capital works and a company preparing a disclosure need different depth and outputs. Decide which parts of the business are included: owned sites only, or leased premises, key suppliers and distribution routes as well. Agree who will use the results and in what form. A clear scope prevents the exercise from becoming either superficial or unmanageably broad.
Step Two: Build the Asset Inventory
Risk is tied to place, so accurate locations are essential. Compile a list of every site with its coordinates, function, value, and contribution to revenue. Add characteristics that affect vulnerability, such as building type, floor levels, age and the presence of critical equipment. Many organisations find that their property records are incomplete or inconsistent. Cleaning this data takes effort but is necessary, and the resulting inventory is useful well beyond the climate assessment, including for insurance renewals and maintenance planning.
Step Three: Choose Scenarios and Horizons
Future emissions are uncertain, so assessments use several scenarios, typically one in which warming is limited and one in which it is high. Select time horizons that match the life of the assets and the planning cycle: near term for operations, mid-century for long-lived property and infrastructure. For each combination, obtain projections for the relevant hazards, including river and coastal flooding, extreme rainfall, heat, drought, wind and wildfire.
Step Four: Account for Local Protection
Hazard alone overstates risk where defences exist and understates it where they are absent or failing. A site behind a well-maintained levee differs from an unprotected one at the same elevation. Good assessments therefore draw on location-by-location adaptation data covering flood defences, drainage, building standards and the capacity of local authorities to respond. This step often changes the ranking of sites and prevents money being spent protecting assets that public infrastructure already shields.
Step Five: Estimate Impact
Translate hazard and vulnerability into consequences. For each site, consider physical damage, the duration of interruption, effects on staff and knock-on effects for customers and other facilities. Where data allows, express these in financial terms such as repair cost and lost revenue. Where it does not, use a consistent qualitative scale. Include indirect dependencies, such as power, water, transport access and telecommunications, since their failure can halt an undamaged site.
Step Six: Rank and Prioritise
Combine likelihood and impact to produce a ranked list. A simple matrix is adequate for many businesses. The purpose is to distinguish the small number of sites that warrant immediate attention from those that need monitoring and those that are of low concern. Review the ranking with people who know the sites, because local knowledge can confirm or correct model outputs. Record assumptions and any adjustments made on local advice so that the reasoning can be examined later.
Step Seven: Decide the Response
For each significant risk there are four broad options. Reduce it through physical measures or operational changes. Transfer it through insurance or contract terms. Avoid it by relocating or exiting. Accept it, knowingly, where the cost of action exceeds the benefit. Each choice should have an owner, a budget and a timetable, approved at the appropriate level. An assessment that ends with a ranked list and no assigned actions has not finished its job.
Documenting for Disclosure
Reporting standards built on the recommendations of the Task Force on Climate-related Financial Disclosures, including those issued by the International Sustainability Standards Board, ask companies to describe governance, strategy, risk management, and metrics and targets. A well-run assessment supplies most of the content. Keep a record of methods, data sources, scenarios and limitations. Auditors and investors will want to see how conclusions were reached, and a transparent account is more credible than a confident summary.
Common Mistakes
Several errors recur. Relying on historical flood maps instead of forward-looking projections. Assessing owned sites and ignoring critical suppliers. Using a single scenario. Reporting hazard without considering vulnerability or existing protection. Presenting precise figures without acknowledging uncertainty. Leaving the work entirely to external consultants so that no one inside understands it. Perhaps the most common is failing to connect results to capital planning, so findings are noted and then set aside.
Keeping the Assessment Current
Conditions, data and the business itself all change, so an assessment should be refreshed on a regular cycle and whenever a major site is added or disposed of. Assign responsibility for maintaining the inventory and rerunning the analysis. Many organisations now use AI-driven climate intelligence to automate the scoring, which makes annual updates practical and frees specialists to concentrate on interpretation. Whatever the tool, the test of success is whether decisions were made differently because of what was learned.