Non-financial risk management: what lies behind a spreadsheet

There is a conversation that has kept coming up in management meetings for the past two years. Someone asks about the company's climate risk, and the answer arrives as a presentation with green, amber and red indicators whose origins nobody can quite explain. Everyone nods. Nobody asks how they were calculated.

That conversation has become uncomfortable for one specific reason: someone outside the room is now asking the same question. And that someone is the bank.

This guide is about moving from traffic lights to something defensible. It is not a regulatory compliance manual — there are plenty of good ones — but an explanation of why non-financial risk management has stopped being a reporting exercise and become a variable in credit discussions. .

What they are, and why the name is misleading

The label "non-financial" is unfortunate. It suggests these risks live somewhere else, far from the income statement, when the opposite is true: they are financial risks that had not yet been priced.

A plant in a flood zone is not an environmental issue. It means interrupted production, replacement costs and a rising insurance premium. A supplier with labour problems is not a social issue: it means a contract that could fall apart and a major customer excluding you from a tender. The difference from credit or market risk lies not in the nature of the damage, but in the fact that we have spent decades measuring some risks and very little time measuring the others.

European regulation has changed that second part. The CSRD introduced the concept of double materiality, which sounds academic but means something quite practical: you have to look in two directions. How the environment affects the company — a drought, a rise in carbon prices, a regulatory change that makes a facility obsolete — and how the company affects the environment. The first direction interests a chief financial officer. The second interests a regulator. And recently, both have started to interest the lender.

The three families, without the usual litany

ESG risks are usually presented as three neatly ordered blocks. In practice, they behave very differently:

Environmental risks fall into two types that should not be confused. Physical risks depend on where things are: a factory, a quarry, a logistics centre. They are assessed by location and climate scenario, and their horizon is usually long. Transition risks depend on what you do: sector, energy dependence, exposure to mechanisms such as the ETS or CBAM. These are much more immediate and, in the Spanish market, are currently putting the greatest pressure on margins.

Social risks have undergone the biggest change in status. Under the CSDDD, responsibility extends to the supply chain, turning a problem at a supplier thousands of kilometres away into your own legal and operational problem. This is where the most companies discover they have no idea what happens two tiers further down.

Governance risks generate the fewest headlines and are the best predictors of trouble. Decisions concentrated in one person, missing internal controls, ongoing litigation, high turnover in key positions. Anyone who has analysed companies knows that half the warning signs are there. What is new is not that they matter: it is that they now have to be documented.

From narrative to numbers

The difficult leap is not identifying risks. Any management team can produce a reasonable list in an afternoon. The difficult leap is measuring them in a way that stands up to questioning.

Saying "we have a medium risk of disruption from climate events" means nothing. It means something to say that two of the four production sites are in a flood-risk zone under an RCP 4.5 scenario with a 2030 horizon, that they represent 40% of capacity, and that a tested continuity plan exists for one of them.

The difference between those two statements separates a report from an analysis. And it is exactly the difference an external verifier or risk analyst notices.

COSO ERM: why this framework rather than another

When a company decides to structure its risk management, the reasonable question is which framework to use. There are several. COSO ERM has prevailed in practice for an unglamorous reason: it is the language internal audit already speaks.

That matters more than it might seem. A risk framework understood only by the sustainability department is an orphaned framework. COSO lets the sustainability manager and chief financial officer discuss the same thing using the same words, while the auditor recognises the structure without needing an explanation.

The model rests on four moves that, without the jargon, are fairly intuitive:

Who is responsible for what. If oversight of these risks is not assigned to a specific person on the board or management team, there is no management: there is a document. This step sinks the most projects and receives the least time.

What we want to achieve. Risks are assessed against objectives. A company that has not decided what it will do about the energy transition cannot assess its transition risk, because it has nothing to measure it against.

How much it hurts and how likely it is. This is where the work becomes technical, and where we will discuss inherent and residual risk below.

And then, keep watching. An eighteen-month-old risk map is a historical document. The regulations require assessment over three horizons — less than one year, up to five, and more than five — which means reviewing it regularly.

Inherent and residual risk: where almost everyone goes wrong

This is the most mishandled part of the methodology, and it deserves some attention.

Inherent risk is what exists if you do nothing. Residual risk is what remains after applying your existing controls. The difference between them is, quite literally, the value of your management work.

The usual mistake is applying a single reduction percentage to both axes. "Our controls are 60% effective, so the risk falls by 60%." It sounds reasonable and is wrong, because controls do not affect likelihood and impact in the same way.

An example. A ceramics company facing rising energy costs has four controls: a long-term supply contract, a financial price hedge, an efficiency plan with approved investment, and a customer pass-through clause.

The first two reduce the likelihood of costs rising. The last two do not prevent anything, but reduce the impact when costs rise. Treating them as equivalent distorts the result.

There is a second, subtler mistake: adding up the effectiveness of all controls as though they were independent. Four controls with 50% effectiveness would, when multiplied together, produce a 94% reduction. Absurd. In practice, controls overlap. The long-term contract and financial hedge address the same problem — energy prices — so the second adds little when you already have the first. If that company genuinely wanted to reduce its exposure, it would have to address consumption, which is a different cause.

That conclusion — where to put the next euro — is what a well-constructed risk map delivers and a list of traffic lights does not.

One final point, and the one that gives you the most credibility with third parties: residual risk never falls to zero, and reductions should have a limit. No combination of controls should be able to reduce a risk by more than two levels on the scale. Without that cap, the matrix becomes an exercise in self-congratulation, and it is the first thing an external reviewer notices.

Two regulatory timetables, and only one has eased

Here is the change that has most reshaped the landscape in recent months, and the one most companies still fail to see.

Two regulatory blocks operate independently in Europe.

The corporate reporting block — CSRD, ESRS, VSME — defines who has to report. This block has eased. The Omnibus package substantially raised the thresholds and delayed new waves of companies entering scope. Many medium-sized companies that had been preparing discovered they were no longer obliged to report, and quite a few concluded that the issue had been postponed.

The banking block — CRR3, CRD6 and the European Banking Authority's guidelines — defines something else: what a bank must assess before granting financing. And that has not eased.

Guidelines EBA/GL/2025/01, applicable from January 2026 for most institutions and from January 2027 for small and non-complex institutions, require banks to assess the ESG risk of every company they finance, integrate it into credit origination and review, and request information to do so.

Here is the detail with the greatest consequences: when the customer does not provide data, the rules allow the bank to estimate it using sector averages, although banks must reduce this practice as the available information improves.

In plain terms: not answering is not neutral. A company that manages well but does not document it ends up assessed against its sector average, which almost never works in its favour. A company that does document it is assessed on its actual profile.

This mechanism also explains why, in February 2026, the Consejo de Finanzas Sostenibles, part of the Ministerio de Economía, launched Eco-Track: a free tool allowing SMEs to provide sustainability information to their banks based on the VSME standard. It is a fairly clear signal of where things are heading.

The CSDDD and the problem of looking downstream

The due diligence directive extends responsibility to the supply chain, a considerable change in scale. Auditing what happens within your own company is a solvable problem. Auditing suppliers in other countries, and those suppliers' suppliers, is a different problem.

The practical response is not to audit everyone — that is not feasible — but to prioritise by criticality and exposure. Which suppliers are irreplaceable, which operate in higher-risk geographies or sectors, and which account for a significant share of spending. The rest are covered through declarations and contractual clauses, recognising that this provides only partial coverage.

How this reaches the cost of capital

Precision matters here, because this is where claims are most exaggerated.

ESG does not enter credit pricing through a single route. It enters through three, with different weights.

The sustainability-linked margin is the most visible: loans with linked targets and a spread adjusted according to performance. The observed market range is usually between 5 and 15 basis points. It is real, but used mainly in large and syndicated transactions; it rarely appears in a three-million bilateral loan to a medium-sized company.

The internal rating is the route that does reach the mid-market, and it matters more than the previous one despite being less visible. The ESG profile acts as a modifying factor in the internal risk classification, which in turn feeds risk-adjusted pricing. It is not experienced as a green discount: it means being one rung higher or lower on the pricing grid.

Collateral valuation is the most direct route and the least discussed. A property's energy certification and exposure to physical risk affect its value, which affects the LTV, the amount granted and the terms. Here, the effect is not on the probability of default, but on the expected loss if default occurs.

There is a fourth effect that matters more to many companies than the previous three: availability. Whether the transaction goes ahead, how long it takes, and what additional requirements apply. For a chief financial officer with a maturity in three months, that is worth considerably more than fifteen basis points.

What cannot be claimed is that good ESG management guarantees an interest-rate discount. It depends on the institution, product, sector and transaction. What can be said is that missing data translates into conservative estimates, and conservative estimates never work in your favour.

The score as an internal tool, not a trophy

An ESG Score makes sense if it helps you decide. As a number to put in a presentation, it adds little.

Its real usefulness is twofold: it shows which areas are dragging down the whole — hence the value of breaking it down into environmental, social and governance dimensions, with explicit weights — and lets you anticipate how a third party will assess you before they do. Knowing that governance stands at 71 and environmental performance at 61 tells you where to work. Knowing the overall score is 68 tells you nothing.

There is one non-negotiable condition for a defensible score: it must include a methodology version. No third party will accept a score without an explanation of how it was calculated, and rightly so.

The problem with spreadsheets

This needs nuance, because the easy argument — "Excel is bad" — is untrue, and anyone who has worked this way for years knows it.

Excel is excellent for calculation. The problem is not calculation: it is everything else.

When the same data must serve the sustainability report, the bank's request and a major customer's questionnaire, and each requires a different format, three versions of the same number start to exist. When a verifier asks where a particular figure comes from and the answer involves opening four files and calling someone who no longer works at the company, there is a traceability problem. And when the next reporting year arrives and collection has to restart from scratch, there is a cost problem that repeats every year.

None of those three is a formula problem. They are problems of continuity, data provenance and scale. And they are exactly the problems a system solves and a spreadsheet cannot, however good it is.

The indicator that best captures this — and, not coincidentally, the one banking guidelines ask institutions to track — is coverage: what percentage of information is backed by measured data and what percentage is estimated. A company that can say "91% of our data is measured, 9% is estimated, and here is the breakdown" is having a different conversation from one that delivers a report without distinguishing between them.

What Voombu does, and what it does not

Voombu is the infrastructure where that data lives: captured once and used across different frameworks — CSRD and ESRS, GRI, GHG Protocol, VSME and the rest — without collecting it again for each one. On that foundation, the risk module applies COSO ERM methodology, distinguishing inherent from residual risk, and generates traceable documentation, with every metric's origin identifiable back to its source.

The limits should be explicit. Voombu does not audit or issue ratings. It prepares information so a third party can verify it, which is a different, complementary function. Nor does it replace a consultant's judgement: a risk map requires decisions about what is material, what falls outside scope and why, and those are professional decisions no tool makes for you.

What it does solve is taking that judgement out of spreadsheets and allowing it to be applied consistently, year after year and across an entire portfolio if necessary.

What to keep clear for 2026

Three ideas, if you only take away a few.

First, the obligation to report and the need to respond are different things, and only one has eased. A company outside the CSRD's scope still has to answer questions from its banks, major customers or European funding programmes.

Second, the real work lies not in the report, but in the structure supporting it. A report can be produced in three weeks with enough effort. A system that lets you repeat it every year, with traceability and without starting from scratch, is something else — and it makes the difference from the second reporting year onwards.

And third, perhaps most uncomfortable: not providing data does not mean you stop being assessed. You are simply assessed using a sector average that rarely works in your favour. The choice is not between measuring and not measuring. It is between measuring yourself and being measured by default.

Frequently asked questions

What is the difference between financial and non-financial risk? Financial risk concerns asset volatility, liquidity and credit. Non-financial risk covers operational, legal, environmental and reputational factors. The distinction is more historical than conceptual: both ultimately reach the income statement, but the latter have been measured systematically for less time.

Is reporting under the CSRD still mandatory? It depends on size. Following the Omnibus package, thresholds rose substantially and many medium-sized companies fell outside mandatory scope. But leaving the CSRD's scope does not remove information requests arriving through other channels: banks, customers subject to the directive and public funding programmes.

How does this affect my company's interest rate? Through three routes. In sustainability-linked transactions, through margin adjustments that typically range between 5 and 15 basis points in the European market. In the institution's internal rating, where the ESG profile acts as a modifying factor. And in collateral valuation, especially property. The specific effect varies by institution, product and transaction, so be wary of anyone promising a fixed figure.

Why COSO ERM rather than another framework? Because internal audit already uses it, making the work recognisable to third parties. A risk framework understood only by the sustainability team has a translation problem whenever it needs explaining externally.

What is a KRI? An indicator measuring exposure to a risk before it materialises. In sustainability, it might be carbon intensity per unit produced, the percentage of suppliers in water-stressed areas, or the average age of assets' energy certifications. Its usefulness depends on frequent review: an annual KRI is historical data.

Does software replace a consultancy? No. Deciding what is material, which risks fall outside scope and how to assess a control that exists but is not formalised requires professional judgement. A platform solves the part that does not require judgement: collecting, structuring, leaving a trail and making the process repeatable. Coincidentally, that is also the part consuming most of the hours.

How is information prepared for external verification? By ensuring every figure has an identifiable source, a documented calculation method, a date and a responsible person, and by making clear what is measured data and what is estimated. A verifier does not expect perfection: they expect traceability. Disclosed gaps can be managed; silent gaps generate qualifications.

Which social risks does the CSDDD prioritise? Human rights and working conditions in the supply chain, focusing on forced labour, occupational safety and associated environmental degradation. Since auditing the entire chain is not feasible for most companies, the reasonable approach is to prioritise by supplier criticality, geography and spending volume.