vaayaa Inclusive Education
Finance risk assessment

ESG Advisory Services Risk Assessment: Claims, Data, Supplier and Site Exposure Controls

A worked example of how an ESG advisory practice identifies, scores and controls risks from greenwashing, measurement errors, supplier impacts, conflicts of interest, permits, extreme weather and uncontrolled releases at client sites.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: Critical to Medium
See the ESG Advisory Services course

Executive summary

This assessment shows how an ESG advisory practice can find, score and control the risks that affect the accuracy of its advice and the people and places its clients affect. Eight risks were chosen because they are plausible in everyday advisory work. Greenwashing, measurement errors and missed site pollution carry the highest scores before controls, with one rated Critical. Supplier gaps, conflicts of interest, permits, stakeholder concern and weather also appear. Each risk is scored before controls and again after existing and added controls. Most fall to Medium or Low once added controls are in place, but site pollution stays at Medium because its impact remains serious. The first actions are a claims checklist, a measurement reconciliation, an independence check before each engagement and a permit register. The practice is a teaching example, so every score illustrates method, not a real organization.

Focus area
ESG advisory and sustainability finance
Setting
Advisory practice supporting companies and investors on environmental, social and governance strategy, data, reporting and due diligence
Method
Five by five likelihood and impact risk register

Scope

This assessment covers an ESG advisory practice that supports client companies and investors on environmental, social and governance strategy, measurement, reporting and due diligence. It covers the advisory team, client engagement files, emissions and performance data, supplier and lifecycle reviews, and advice on permits and environmental performance. It does not cover certification decisions, legal opinions, investment decisions or the operations of any real company. Jurisdiction, client sectors, site types and systems are assumptions made for teaching.

Context

The practice has a lead partner, four consultants who run client projects, a data analyst, and a small compliance and quality team. Client data arrives as spreadsheets, utility bills, supplier questionnaires and site reports, and is combined in a shared analysis tool. Advice is delivered as written reports, dashboards and board presentations. Projects include site visits to factories, warehouses and extraction or processing sites where the practice does not hold operational control. Each risk is scored before controls to show its natural level, then again after the existing controls and the controls that should be added.

Objectives, assets and stakeholders

The objective is to give accurate, independent and defensible ESG advice, protect the people and places affected by client activity, meet the reporting and permit duties that apply, and keep the trust of clients, investors and communities. The assets in scope are client engagement files, emissions and performance data, the analysis tools, the practice reputation and the professional independence of its consultants. Stakeholders include consultants, the lead partner, clients and their boards, investors, suppliers, nearby communities, workers at assessed sites and regulators. Clear roles matter: every risk has one owner role, and the head of quality reports the register to the partners each quarter.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 3, score 12, high: H02 Likelihood 4, impact 4, score 16, high: H01 Likelihood 4, impact 5, score 20, critical: H08
3 Possible Likelihood 3, impact 3, score 9, medium: H05 Likelihood 3, impact 4, score 12, high: H03 H06
2 Unlikely Likelihood 2, impact 5, score 10, high: H04 H07
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible
2 Unlikely Likelihood 2, impact 2, score 4, low: H04 H05 Likelihood 2, impact 3, score 6, medium: H01 H02 H03 H06 Likelihood 2, impact 4, score 8, medium: H07 H08
1 Rare
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Greenwashing in client claims and advisory wording 16 High 6 Medium Head of quality and assurance
H02 Inaccurate emissions and performance measurement 12 High 6 Medium Lead data analyst
H03 Supplier and lifecycle impacts left out of advice 12 High 6 Medium Engagement manager
H04 Conflicts of interest in ESG advice and ratings 10 High 4 Low Compliance officer
H05 Stakeholder concerns escalating into public dispute 9 Medium 4 Low Stakeholder engagement lead
H06 Missed permit conditions and environmental reporting duties 12 High 6 Medium Regulatory specialist
H07 Extreme weather and equipment failure at assessed sites 10 High 8 Medium Project director
H08 Uncontrolled pollution at a client site missed in due diligence 20 Critical 8 Medium Environmental due diligence lead
H01

Greenwashing in client claims and advisory wording

Legal and compliance Before 16 After 6

Client sustainability claims, marketing statements or advisory reports overstate progress, use vague terms or omit material facts, so the practice is seen as endorsing misleading statements to investors and customers.

Who or what is affected: Investors, customers, client boards and the practice

Causes

Pressure to present strong results, marketing teams editing wording late, and unclear evidence standards.

Consequences

Regulatory scrutiny, client disputes, loss of credibility and reputational harm to the practice.

Existing controls

  • Senior partner reviews final reports before release.
  • Client claims must cite a source document in the working file.

Control gaps

Wording changes made after partner sign-off are not re-checked against the evidence file.

Additional controls

  • Prevent: Run a claims checklist that flags absolute, vague or unsupported wording before any report is issued.
  • Detect: Sample published client statements each quarter and compare them against the evidence on file.
Likelihood 4 x impact 4 before; 2 x 3 after Owner: Head of quality and assurance Target: Within 30 days Early warning: A client statement or draft report that uses absolute terms with no supporting source.
H02

Inaccurate emissions and performance measurement

Technology and data Before 12 After 6

Emissions, energy, water or waste figures are calculated from incomplete, outdated or wrongly converted data, or are copied between spreadsheets with errors, so reported performance does not match the real operations.

Who or what is affected: Client management, investors, data analysts and report readers

Causes

Manual copying, missing meter data, changing factors and estimates that are not labeled as estimates.

Consequences

Restated reports, misled investors, client complaints and weakened trust in the advice.

Existing controls

  • Analysts record the source and calculation for each figure.
  • A second analyst checks totals before a report is drafted.

Control gaps

Estimates are not flagged in the final dashboards, and factor updates are not logged.

Additional controls

  • Prevent: Use locked calculation templates with version control and documented emission factors for every category.
  • Detect: Reconcile client totals to utility bills and invoices and investigate any gap above an agreed tolerance.
Likelihood 4 x impact 3 before; 2 x 3 after Owner: Lead data analyst Target: Within 45 days Early warning: Reconciliation gaps above tolerance between client totals and source bills.
H03

Supplier and lifecycle impacts left out of advice

Supplier Before 12 After 6

Advice covers the client own site but ignores upstream suppliers, product use and end of life, so labor abuse, pollution or resource depletion in the supply chain go unnoticed and the client receives an incomplete picture.

Who or what is affected: Supplier workers, client customers, local communities and the client

Causes

Limited supplier visibility, reliance on self declared answers and fixed scope in contracts.

Consequences

Missed human rights or environmental harms, client exposure to supply shocks and weak due diligence records.

Existing controls

  • Supplier questionnaires are sent to key suppliers.
  • Major supplier categories are listed in each engagement plan.

Control gaps

Questionnaire answers are accepted without a check against any independent evidence.

Additional controls

  • Prevent: Set a scope rule that includes tier one suppliers with high impact categories in every lifecycle review.
  • Detect: Compare questionnaire answers with independent audits or site evidence where available, and record gaps.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Engagement manager Target: Within 60 days Early warning: Key suppliers that return questionnaires with no evidence attached.
H04

Conflicts of interest in ESG advice and ratings

People Before 10 After 4

A consultant holds a financial, family or business link to a client, a rating provider or a supplier being assessed, which weakens the independence of advice or leads to favorable scores.

Who or what is affected: Clients, investors, consultants and the practice

Causes

Long client relationships, incentive pay tied to client wins and unclear rules on gifts and referrals.

Consequences

Loss of independence, disciplinary action, legal challenge and damage to professional standing.

Existing controls

  • Staff declare outside interests when they join.
  • Engagement letters state the scope and independence position.

Control gaps

Declarations are collected once a year and are not compared with new engagements.

Additional controls

  • Prevent: Run an independence check against the client and supplier list before each engagement starts.
  • Respond: Remove the conflicted consultant from the work and record the reason and the replacement.
Likelihood 2 x impact 5 before; 2 x 2 after Owner: Compliance officer Target: Within 30 days Early warning: A declared interest linked to a supplier or client on an open engagement.
H05

Stakeholder concerns escalating into public dispute

Reputational Before 9 After 4

Local communities, workers, nongovernmental groups or investors raise concerns about a client project, and the practice fails to listen, respond or record concerns properly, so disputes grow and advice is challenged in public.

Who or what is affected: Local residents, workers, client staff and the practice

Causes

Poor early consultation, unclear project impacts and concerns that are passed on informally.

Consequences

Public dispute, delayed projects, client loss and harm to the practice reputation.

Existing controls

  • Engagement plans list the main stakeholder groups.
  • Consultants record meeting notes with stakeholders.

Control gaps

Concerns raised by phone or at site visits are not logged in the central record.

Additional controls

  • Prevent: Build a stakeholder map with concern themes and agreed response owners at the start of each project.
  • Respond: Log every formal concern, acknowledge it within an agreed period and report the outcome to the client board.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Stakeholder engagement lead Target: Within 60 days Early warning: Repeated complaints on the same theme that are not closed within the agreed period.
H06

Missed permit conditions and environmental reporting duties

Legal and compliance Before 12 After 6

Advice on permits, emissions limits or environmental reporting is based on outdated conditions or incomplete records, so a client misses a deadline, exceeds a limit or files an incorrect return.

Who or what is affected: Client management, regulators, local communities and the practice

Causes

Permit changes not passed on, staff turnover at the client and reliance on memory for due dates.

Consequences

Penalties, enforcement notices, operational restrictions and damage to the client license to operate.

Existing controls

  • Consultants check permit conditions against the latest issued permit.
  • Filing dates are placed in the engagement calendar.

Control gaps

Permit variations are not tracked centrally, so advice may rely on superseded conditions.

Additional controls

  • Prevent: Keep a permit register with each condition, owner, reporting date and the source document reference.
  • Detect: Review permit compliance status with the client monthly and test a sample of returns before submission.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Regulatory specialist Target: Within 30 days Early warning: A permit condition due within 14 days with no named owner or evidence of progress.
H07

Extreme weather and equipment failure at assessed sites

Operational Before 10 After 8

Flooding, heat, storms or failed cooling and containment equipment at a site visited or assessed by the practice disrupt operations, damage assets and cause releases, while the advice assumed normal conditions.

Who or what is affected: Site workers, visiting consultants, neighbors and the client

Causes

Changing weather patterns, ageing equipment and assumptions that conditions remain stable.

Consequences

Injury, asset damage, uncontrolled release, business interruption and inaccurate advice.

Existing controls

  • Site visits follow the client safety induction.
  • Climate exposure is noted in the project brief where data is available.

Control gaps

Physical climate data is not checked against the asset list or updated for new seasons.

Additional controls

  • Prevent: Add a physical climate screen with hazards, asset locations and design margins to each site assessment.
  • Respond: Agree a weather stop rule and an evacuation point for consultants before any site visit.
Likelihood 2 x impact 5 before; 2 x 4 after Owner: Project director Target: Within 60 days Early warning: Forecast severe weather near an assessed site or a failed alarm on containment equipment.
H08

Uncontrolled pollution at a client site missed in due diligence

Environmental Before 20 After 8

Contamination, leaks or uncontrolled releases of oil, chemicals, dust or wastewater at a client or target site are not found during due diligence because sampling was limited, so liabilities and harm to nearby land and water are carried into the deal.

Who or what is affected: Neighbors, ecosystems, workers, investors and the client

Causes

Limited sampling budget, reliance on desk records and pressure to meet deal timelines.

Consequences

Contamination liability, remediation costs, harm to ecosystems and workers, and loss of investor confidence.

Existing controls

  • Due diligence checklists include a desk review of past incidents.
  • Site visits note visible staining, odors and waste storage.

Control gaps

Scope decisions to skip sampling are not recorded or reviewed by a second person.

Additional controls

  • Prevent: Require sampling and a site history review where prior industrial use or incident records exist.
  • Detect: Compare site monitoring results with baseline data and escalate any unexplained trend to specialist review.
  • Recover: Agree remediation options and cost ranges with the client before the deal closes.
Likelihood 4 x impact 5 before; 2 x 4 after Owner: Environmental due diligence lead Target: Within 30 days Early warning: Unexplained variation in site monitoring results or staining found without a documented cause.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and impact runs from Insignificant to Severe. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. The score is a guide for ordering work, not a measurement. Inherent risk is the score before any controls. Residual risk is the score after the existing and added controls. Impact is judged on harm to people and ecosystems, financial loss, legal exposure and damage to trust, and a reputational or environmental risk is never rated down only because it has not yet happened. Anything still High needs partner attention and a dated plan, anything Medium needs routine controls with a named owner, and anything Low is accepted and watched. Consultants and the quality team should challenge the ratings, and each risk is reviewed whenever its indicator reaches its threshold.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Published client statements or draft reports that use absolute terms with no source in the evidence file.Escalate to the head of quality and assurance at once, and hold release until the evidence is confirmed.
Reconciliation gaps above the agreed tolerance between client totals and source utility bills.Escalate to the lead data analyst when a gap is found, and to the engagement manager if it is not explained within 10 days.
Declared interests linked to a client or supplier on an open engagement.Escalate to the compliance officer on discovery, and remove the consultant from the work pending review.
Unexplained variation in site monitoring results or staining found without a documented cause.Escalate to the environmental due diligence lead at once, and to the lead partner if the cause is not known within 5 days.
Permit conditions due within 14 days with no named owner or evidence of progress.Escalate to the regulatory specialist when identified, and to the client board if the deadline is at risk.

Contingency arrangements

If a serious event occurs, such as a confirmed misleading claim, a site release or an extreme weather event at an assessed site, the lead partner pauses the related report or site work and informs the client. The quality lead preserves the evidence file and the version history. Consultants leave any unsafe site and report to the project director. Specialist environmental and legal advisers are engaged through the client and the practice compliance officer, as the jurisdiction requires.

Prioritized action plan

  1. Introduce a claims checklist and evidence sign-off before any report or public statement is released, owner head of quality and assurance, within 30 days.
  2. Require sampling and site history review in every due diligence project with prior industrial use, owner environmental due diligence lead, within 30 days.
  3. Run an independence check before each engagement and an annual declaration review, owner compliance officer, within 30 days.
  4. Reconcile client emissions and performance totals to source bills and lock the calculation templates, owner lead data analyst, within 45 days.
  5. Create a permit register with conditions, reporting dates and owners for each client, owner regulatory specialist, within 30 days.

Conclusion

Credible ESG advice depends on a few steady habits: evidence for every claim, reconciled data, independent checks on people and suppliers, a permit register and a plan for weather and site risk. The highest scores sit with misleading claims, measurement errors and missed site pollution, and each has actions that bring the residual score down. Treat the register as a living record, review it on the stated cycle, and seek qualified environmental, legal and financial advice for any real decision.

Assumptions and limitations

Assumptions

  • The practice advises clients but does not operate their sites, so client operational controls sit with the client.
  • Jurisdiction is not specified, so reporting and permit duties are described in general terms only.
  • Consultants are qualified professionals who work under a written engagement letter and an internal quality process.

Limitations

  • The scores are examples for learning and do not describe any real practice, client or site.
  • Environmental, reporting and financial disclosure rules differ by country and change over time, so specialist review is needed.
  • This is educational content and is not legal, financial, environmental or investment advice.

Related frameworks to study

  • Three lines model of risk ownership
  • Hierarchy of controls
  • Likelihood and impact risk register method
  • Internal quality review and sign-off process

Finance Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

ESG Advisory Services course Read the best practices for this course

More Finance risk assessments

Hourly Active: 45,552 Learners