Managing ESG risks under COSO ERM: strategic integration and compliance

In most mid-sized companies, finance and sustainability still do not speak the same language. Finance manages cash, covenants and solvency; sustainability reports qualitative metrics in documents that almost nobody on the executive committee opens twice. The result is familiar: when a bank, a large customer or a verifier asks how a climate or social risk affects the income statement, the answer is improvised. And an improvised answer cannot be defended.

The good news is that fixing this does not require inventing a new methodology. Managing ESG risks under COSO ERM means precisely bringing environmental, social and governance factors into the control framework that the board of directors and auditor already know and respect. In this article, we look at why the traditional approach falls short, how COSO's five components are adapted to sustainability, how to move from qualitative assessment to quantification in euros, and a realistic implementation roadmap.

 

Why the traditional approach to risk is no longer enough

Traditional ERM falls short on sustainability for three specific reasons. The first is time horizons: financial risk is considered in quarters or years, whereas a physical or transition climate risk unfolds over decades — and requires scenario analysis that the traditional model rarely accommodates. The second is double materiality: assessing how the environment affects the company is no longer enough; European standards also require documentation of how the company's activities affect the environment. The third is regulatory volatility: in the European Union, the rules have shifted more in two years than in the previous decade — the Omnibus is the clearest example — and a purely reactive control structure is always too late.

Added to this is a shift in incentives that should not be overlooked: although direct legal reporting obligations have been reduced for many mid-sized companies, market demands have not. Financial institutions apply spreads according to the borrower's ESG profile, and large customers pass their requirements down the value chain. Poorly managed risk is no longer paid for only in penalties: it is paid for in the cost of capital.

 

The five components of COSO ERM applied to sustainability

Integrating ESG into COSO does not mean adding a column to the risk matrix. It means examining each of the framework's five components through a sustainability lens.

Governance and culture: the tone from the top

Oversight of ESG indicators must sit with the board — in its audit and risk committees — rather than being diluted within a department without decision-making authority. One lever that works is linking part of management's variable remuneration to verified sustainability targets. When incentives depend on verified data, interest in data quality spreads naturally throughout the organisation.

Strategy and performance: identifying and assessing what matters

Identifying climate and social risks requires more than intuition: heat maps combining probability and financial impact, attention to emerging risks (biodiversity, human rights in the supply chain) and scenario analysis to test the strategy's resilience. Equally important: a decarbonisation plan without financial viability is not an ambition; it is an execution risk. Our specialist risk module provides a systematic way to map these risks against the ESRS and GRI standards, applying this logic without a black box.

The remaining two components close the loop: continuous review — adjusting the model when the science or rules change, not at the next annual review — and reporting, which must reach investors and verifiers in a consistent, traceable form, without ambiguities that suggest a lack of control.

 

From qualitative assessment to financial quantification

This is the line separating risk management from a narrative exercise: if you cannot express an ESG factor's impact on cash flow, you are not yet managing it. Quantification involves specific techniques, none of them exotic. Scope 3 emissions translate into contingent liabilities when suppliers face carbon taxes or supply pressures. An internal carbon price makes it possible to assess investments under different tax scenarios and avoid stranded assets on the balance sheet. Even reputational risk can be measured: through turnover among key employees or lost contracts.

There are two methodological distinctions that a third party will always examine. First, the difference between inherent risk — the risk arising from your sector and activities — and residual risk — what remains after your controls: residual risk never falls to zero, however many controls are declared. Second, the dynamic score versus the fixed snapshot: an ESG assessment updated with actual data can support negotiations; one rebuilt once a year is always out of date when it arrives.

 

Roadmap: implementing the COSO-WBCSD framework without getting overwhelmed

The COSO-WBCSD guidance applies the 2017 ERM framework to sustainability, and implementation can be summarised in five steps that should be taken in sequence. One: gap assessment — compare current ERM with the ESG risks identified and establish what is missing from the financial radar. Two: risk appetite — decide how much climate or social exposure the balance sheet can absorb before profitability is compromised, and put it in writing. Three: automated data capture, because a typing error in a spreadsheet is the silent enemy of the entire structure. Four: reporting routines that bring ESG performance to the executive committee in a dashboard, not an appendix. And five: end-to-end traceability — every data point traceable to its origin, because that is the first thing an external verifier requests.

The value chain counts too

Responsibility does not stop at the office door: the environmental and human rights risks associated with critical suppliers belong in the risk map. Precision about the framework matters: following the Omnibus, mandatory due diligence (CSDDD) was restricted to companies with more than 5,000 employees and postponed until 2029 — but large customers have not waited: they pass these requirements on to suppliers through contracts, using the voluntary VSME standard as the reference format. Monitoring the chain through early warnings is no longer a luxury. To bring all this information together under a single data model, you can implement an ESG data governance platform.

Responding to risk and communicating it in an auditable way

Once a risk is identified, four responses are possible — avoid, reduce, share or accept — alongside one overarching obligation: documenting why each response was chosen. Taking action is not enough for an auditor; the reasoning must be demonstrable. The cycle closes with reporting in XBRL format in accordance with the European taxonomy: machine-readable, comparable data ready for any requirement from regulators or the market.

 

Voombu: the infrastructure that makes COSO work

All the theory above stands or falls on data quality. Voombu addresses that foundation through a simple principle: one data point, every framework. Information is entered once — together with its source, evidence and owner — and the mapping engine connects it to internal controls and the ESRS and GRI standards, without duplicate entry or manual reconciliations. The executive committee sees the result in a dashboard translating technical metrics into financial language: how much risk exists, how much is covered and how much the uncovered portion costs.

The ESG Score is calculated from that same data using transparent weighting — 40 % environmental, 35 % social, 25 % governance — aligned with the logic of the major agencies and adapted to the mid-market. A score of this kind, supported by evidence, provides a real argument when negotiating sustainable financing: depending on the starting bracket, an improved risk profile can mean a reduction of between 5 and 15 basis points in the cost of capital.

Traceability closes the loop: every reported figure remains linked to its source document, the platform generates the documentation package for the external verifier, and outputs are available in editable Word, PDF and XBRL. Voombu does not audit or certify — it prepares the data for review by an independent third party, which is precisely what gives the result its value.

 

Lead the transition towards traceable governance

Integrating sustainability factors into the balance sheet is no longer an aesthetic choice: it is what capital markets demand and what separates companies that negotiate their financing from those that simply accept it. Closing the gap between finance and sustainability requires a methodology — COSO provides it — and data infrastructure that can sustain it over time. If you want to see how this applies to your circumstances, request a Voombu demo: in a 30-minute session, you will find out which frameworks apply to you, what your risk map would look like and where to start.

 

Frequently asked questions about sustainability risk management

What is the COSO ESG guidance and how does it differ from traditional COSO ERM?

It is the document COSO developed with WBCSD to apply the 2017 ERM framework to sustainability risks. The difference lies in its scope: where traditional ERM looks at short financial horizons and internal risks, the guidance incorporates long-term environmental and social factors — climate, human rights, the value chain — using the same control structure the board already employs.

How does COSO ERM help with CSRD compliance in Spain?

CSRD integrates risk management into the annual management report and requires documented double materiality. COSO provides the internal control structure to achieve this with evidence: risks mapped against the ESRS, documented controls and traceable data that can withstand external verification. In Spain, it is also important to remember that the EINF under Ley 11/2018 remains in force for companies with more than 250 employees.

Is COSO mandatory for ESG risk management?

No. No regulation mandates COSO as the only framework. However, it is the internal control standard that auditors and financial committees already know, and using it reduces friction: you speak the same language as the person reviewing your work. That is the practical reason it has become the reference point.

How are ESG risks quantified in financial terms?

By translating a non-financial event into its effect on cash: the cost of a carbon tax on Scope 3, the value of a physical asset in an area exposed to climate risk, or revenue lost through a reputational crisis. Internal carbon prices and stress tests allow the move from a subjective scale of 1 to 5 to a model expressed in euros that a credit committee can discuss.

What role does technology play in implementation?

It eliminates the weak point in the entire system: manual capture. A platform automates data collection together with its evidence, maps the data to current frameworks and maintains an immutable change log. Without that, even the best COSO design deteriorates as quickly as the spreadsheets supporting it.

How does this management approach affect my company's ESG Score?

Directly: a risk subject to demonstrable internal control reduces the risk profile perceived by agencies and financial institutions. The score improves because it is supported by evidence, and that improvement can translate into better terms when negotiating or refinancing — typically between 5 and 15 basis points, depending on the bracket.

What do mid-sized companies gain from this framework?

Professionalising governance before being required to: answering questionnaires from large customers, defending their profile before the bank and avoiding the additional cost of an emergency implementation. For a mid-sized company, arriving prepared is cheaper than arriving under pressure.

Does Voombu audit risks managed under COSO?

No — and that is deliberate. Voombu centralises evidence, generates complete traceability from data to report and produces XBRL files ready for verification, but the audit is always carried out by an independent third party. Our role is to ensure that third party finds an orderly environment, not a reconstruction.