Risk Assessment — Direct Operations

Your own sites, scored one by one on climate, water, biodiversity, forests, regulatory, operational and social risk — current conditions and SSP scenarios to 2030, 2050 and 2080 — with the adaptation catalogue and the local regulations attached site by site.

In scope

Your sites, and nothing you have to chase from a third party

This is the scope you fully control, and the one every framework starts with. It is also the fastest to run: the data is yours, or it is public.

Every production site, warehouse, office and R&D centre, geocoded and cross-checked against its coordinates
Eight risk categories per site, weighted into one score — water 25%, climate 20%, biodiversity 15%, operational 15%, regulatory 10%, supply chain 10%, forests 5%, social reported separately
Current conditions plus SSP1-2.6, SSP2-4.5 and SSP5-8.5 at 2030, 2050 and 2080
Asset value, headcount, water and energy consumption, strategic importance — the sensitivity side of every score
Local regulations attached site by site and country by country, with the obligations register that ISO 14001 §6.1.3 asks for
AI-assisted discovery of the locations you did not list, checked against SIRENE, ICPE, OSM and E-PRTR, with a confidence score and human validation

How it runs

Four steps, and a consultant at the end of each one

Scope and data collection
One structured form for your sites. We geocode, cross-check and come back to you on what looks incomplete — usually within the first week.
Enrichment and scoring
WRI Aqueduct 4.0, IUCN STAR, WDPA, KBA, Global Forest Watch, ERA5 and CMIP6, PVGIS and VigiEau. Every value keeps its source; every score keeps the factors behind it.
Adaptation and costing
Any category reaching 3 out of 5, at the reference scenario or under the SSP5-8.5 stress test, opens the adaptation catalogue, ranked by effect over cost under ISO 14090 and ISO 14091.
Review and debrief
A consultant reviews every analysis before it reaches you, then walks your teams through it at the level each of them needs.

Continuity case

A continuity break, developed end to end

A risk is only useful once it is developed end to end. Here is one of your own sites, followed from the hazard to the insurance arbitrage and then to the exact line it fills in the ESRS and in CDP.

Monterrey plant — specialty chemicals (demo data)Water 5.0/5 · Operational 4.07/5 · Strategic importance 4/5 · €72M insurable value · Aqueduct water stress “Extremely High (>80%)”

Water scores 5.0 out of 5 today and stays at 5.0 under every SSP pathway to 2080 — a present risk, not a future one. The trigger is administrative: the plant draws under a CONAGUA concession, and when a restriction period opens, industrial allocation is cut first. Allocation drops, process flow drops, lines stop partially, downstream customers go short, penalties and de-listing follow.

Item	Value	Where it comes from
Asset damage — water	€7.2M	€72M × 10% max damage ratio × 5.0/5
Asset damage — operational	€7.0M	€72M × 12% max damage ratio × 4.07/5
Downtime	10 days per year	Tool scale: 10 days from a score of 4, 5 days at 3, 2 days at 2
Business interruption	10 × site revenue ÷ 365	Site revenue as you declare it
Insurance	BI sub-limit €5M against €7.2M of exposure — the weak point, not the premium	Declared values and downtime per site, to take to your broker
ESRS	E1-9 · E3-5 · 2 SBM-3 · 2 IRO-1	Assets at risk, monetary amounts, link to the model
CDP	3.1.1 · 3.1.2 · 5.1.1 · module 9 (9.15)	Register, amount vulnerable, scenarios, water

Order of magnitude for prioritising, to be calibrated with your insurer. Damage ratios and the downtime scale are written down and adjustable with you.

Compliance tables

The compliance tables you actually reuse

Annexes A to I are delivered in Excel, Word, PDF and an HTML explorer. They are the part clients come back to: not the narrative, the tables. Each one is produced from the data the assessment already holds, so nothing is retyped and every cell keeps its source.

Annex	Table	What is in it
A	World inventory of labels, certifications, standards, ratings and regulations	147 instruments, 19 columns each — issuing body, jurisdictions, thresholds, deadlines, procedure, validity, official source, verification date, confidence and limits
B	Schemes by company and site	What applies to each entity and each location, split between held and verified, declared, relevant to examine, and recommended — with the justification and the missing data named
C	Risks / scenarios / trajectories / schemes matrix	Every risk crossed with the scenario, the trajectory and the instrument it feeds — this is the table that turns an assessment into a questionnaire answer
D	Verbatims and documentary evidence	Exact excerpts with their source and date; model excerpts and demo texts are labelled as such
E	Gap analysis	Requirement by requirement: evidence available, declared but unverified, planned, or open
F	Prioritisation matrix	Effect over cost, with a no-regret bonus, so the order of work is argued rather than asserted
G	Trajectories, targets and indicators	The baseline, the target, the pathway and the indicator that proves it moved
H	Register of sources and assumptions	Every value with where it came from, when, and what was assumed — the annex auditors open first
I	Consolidated action plan	One line per action: budget, owner, date, ISO clause, CDP question, residual risk

Applicability is shown as likely and confirmed with you — it is never asserted for every entity. Obligations are kept apart from voluntary schemes, and no certification is said to reduce a risk: the mapping states what the scheme structures or evidences.

What you get

The same four levels of reading

Interactive map and per-site tables

Every site, every category, every factor, with the source of each value and the scenario grid.

Executive and management packs

Five slides for the executive committee; dashboard, risk matrix, site priorities, budget and ROI for the management committee.

Technical and operational packs

Seven themes in three passes for the technical teams; one sheet per action for the operational teams, scheduled over 30 working days, 12 weeks and a 36-month budget, with a Gantt chart.

Annexes A to I

In Excel, Word, PDF and an HTML explorer — the inventory, the schemes per site, the risk matrix, the evidence, the gap analysis, the prioritisation, the trajectories, the sources and the plan.

What it answers

CDP Climate · Water · Forests — risk tables 3.1.1, 3.1.2, 3.6.1 and scenario fields 5.1.1, 5.1.2
ISO 14001 — context, compliance obligations, risks and opportunities, clause by clause
ISO 14090 / 14091 — adaptation planning and climate vulnerability assessment
ESRS E1, E3, E4 — own-operations datapoints
EcoVadis — Environment
TCFD · TNFD — physical risk
ISO 14046 — water footprint on the most water-intensive sites

Pricing on request, set with you once the number of sites and materials is known.

How it grafts on

This is a system, not a report. It grafts onto what you already run: the site goes into the insurance programme, the exposure into the business plan, the mitigation into the ISO 14001 improvement programme, the figures into CDP and the ESRS, and the decision into the committee that was going to meet anyway. One assessment, one set of figures, every function reading its own line of it — that is the link it exists to create.

Going further

Risk Assessment — Value Chain

Suppliers, subcontractors, products and customers scored on the same engine. CSRD, CSDDD and EUDR ask for that scope, and so does CDP once you report supply chain risk.

Contact