Why Aligning ESG, ERM, and Third-party Risk Management is Key to Creating Value

From pandemics to climate change, many of the risks we face today are compound risks, connected to each other, and affecting multiple parts of the business simultaneously. These risks often unfold in quick succession and require escalating effort to manage. Keeping these risks in check calls for a robust risk management approach– one that provides the frameworks, standards, processes, controls, and reporting that can adapt to and apply across diversifying and emerging risk categories. 

One of the most talked about business challenges in recent times environmental, social, and governance (ESG) practices. ESG is a rapidly evolving practice that encompasses a wide range of issues, including defining and reporting your organization’s carbon emissions, sustainability, and diversity and inclusion initiatives to name a few. As more companies are being held accountable for their ESG performance by investors, consumers, communities, and regulators, the demand for greater transparency and accountability is increasing. Known risk management practices, disciplines, and analytics can be beneficial to ESG practitioners working toward improved standards, reporting, and market acceptance.

Third-party risk management (TPRM) is an important element within the reporting scope of an ESG initiative because we now know that for many organizations, most of their carbon emissions come from their supply chain. Yet, passing the buck onto suppliers isn’t an acceptable option. Today’s investors, regulators, and consumers hold first parties accountable for third-party failures as much as if not more than the third parties themselves, making it imperative to extend GRC disciplines across the third-party ecosystem. 

Ultimately, the connections between enterprise risk management (ERM), ESG, and TPRM is inescapable. Where a company may be perceived as having ESG risks, a standardized ERM approach can help them manage and mitigate the potential reputational fall-out. Similarly, where a company's relationships with a third party may impact its ESG performance, an integrated TPRM program under the umbrella of or applying best practices gleaned from an ERM program can help ensure that those relationships are managed in a responsible and sustainable manner. 

ESG and TPRM are both standalone risk categories, yet are increasingly interwoven into larger governance, risk, and compliance (GRC) and enterprise risk management programs. We expect deeper interconnectivity and interdependencies to emerge across these components into the whole. What’s already evident is that with effective and integrated ERM processes, companies can build more sustainable businesses, optimize third-party relationships, and create long-term value for all stakeholders.