Managing climate risk
A fire in the Gironde, a heatwave slowing down a production line, a flood cutting off a warehouse: climate risk affects any company with a site, supplier, or supply chain exposed to the climate. This article details a four-part method to document and manage that risk before it happens.
Temps de lecture estimé : X min
In recent days, wildfires in the Gironde region have moved closer to major industrial sites: ArianeGroup, Dassault Aviation, Thales, and dozens of less visible subcontractors that are just as dependent on the area. No damage to these sites has been confirmed.
This episode raises a question: did these companies know exactly how exposed they were, and did they have a course of action ready to be triggered?
The same question applies to a heatwave that slows down a production line, a flood that cuts off access to a logistics warehouse, or a drought that weakens an agricultural supplier. Climate risk is no different from any other risk to manage. It follows the same rules as cybersecurity, supplier failure, or regulatory risks: it must be documented, quantified, and managed.
Two approaches
When facing climate risk, two approaches stand out, and they are handled differently.
The first is proactive : reducing exposure before the risk materializes. This means diversifying critical suppliers to avoid dependence on a single site in a high-risk zone. It means adapting infrastructure: cooling systems for heatwaves, drainage and elevated areas for floods, and firebreaks and brush clearing for wildfires. It also means reviewing the location of new sites based on climate projections rather than just land costs.
The second is reactive : responding quickly when the risk occurs. This requires three things to be in place before the event, not during: an identified person in charge who knows the matter falls to them, a signal that triggers the alert (fire vigilance level, weather warning, temperature threshold), and a pre-calculated action plan ready to be implemented without last-minute decision-making.
Many companies work on the proactive side without structuring the reactive side, or vice versa. A site adapted for floods but lacking a business continuity plan remains vulnerable the day the water rises higher than expected. A well-honed alert procedure without reducing exposure simply repeats the same crisis every year, at the same cost.
The four-element framework
Structuring a risk, whether climate-related or otherwise, means documenting four specific elements for every identified risk.
- An owner : a specifically designated person or team who knows they are responsible for managing that risk. Without a name attached, an identified risk remains an orphan line in a spreadsheet that no one reviews.
- A quantified financial impact : a specific amount, not just a gut feeling. How much would a week-long site shutdown, the loss of a sole supplier, or post-disaster restoration actually cost? This figure changes everything: it allows you to prioritize between risks and justify a prevention budget before the risk becomes more expensive than the prevention itself.
- A trigger : the concrete signal that indicates the risk has been activated. A fire alert level, a rainfall threshold, or a three-day heatwave warning. This signal turns vague concern into a timely decision.
- A budgeted action : what the company does to reduce the likelihood of the risk, limit its effects, or remediate it once it has occurred, with a dedicated budget already in place. An action without a budget is just an intention.
Without these four elements, a risk is just a line in a spreadsheet. With them, it becomes manageable: you know who is acting, when, with what resources, and for what expected financial outcome.
Work that is encouraged by regulations, without being mandatory for everyone
Large companies subject to the CSRD are already documenting part of this work through the ESRS E1 double materiality analysis, which requires the identification of acute and chronic physical climate risks, site by site, along with the associated adaptation measures.
This obligation only applies to a fraction of exposed companies. Tier 2 or 3 subcontractors, often outside the direct scope of the CSRD, carry a significant portion of the actual risk: they are the ones operating the oldest sites, with the least room to diversify their suppliers, and the fewest resources to formalize this monitoring. Yet, their operations determine those of the prime contractors, who are themselves closely monitored by their clients and investors.
Managing climate risks does not need to wait for a regulatory requirement to provide value. An SME that identifies its three most exposed sites, designates a manager for each, and calculates the cost of a production shutdown has already done the essential work, without having opened a single sustainability report. Insurers and certain major prime contractors are, in fact, starting to request this level of detail from their suppliers, regardless of any legal obligation.
What Harnest structures
Harnest was built to make this process operational rather than theoretical. Each risk is documented with its owner (person or team), its financial impact (short, medium, and long-term magnitude, probability), its origin (cause, entity involved, value chain), and the actions attached to it, including their status and budget.
The platform also incorporates the concept of a risk indicator: a pre-defined trigger that signals when the probability of a risk is increasing and it is time to act. An alert system complements this monitoring: risks without an identified owner, unbudgeted actions, or risks that haven't been updated in several months. These are the signals that distinguish a managed risk from one that is simply listed.
The Gironde case, one illustration among many
An industrial site near a fire-prone area shouldn't wait for a blaze to break out to know who is in charge of evacuation, which supplier will step in, and what budget has already been allocated for such an eventuality. The same logic applies to a warehouse in a flood zone, where the plan should be in place well before the water rises, or to a production line vulnerable to heatwaves, where the temperature threshold for slowing down operations is set before summer, not during it.
The difference between a company that suffers from a climate event and one that navigates it without major damage is rarely down to luck. It comes down to preparation: documented processes, clear ownership, defined triggers, and budgets ready before the event occurs.