Page 612 - COSO Guidance

3. Performance for ESG-related risks

Apparel manufacturing company: Delphi approach for human rights-related risks

An apparel company uses the Delphi approach to prioritize risks with the executive committee, including
representation from finance, supply chain and operations.

The human rights manager identified the risk of human rights impacts that threaten the company’s
reputation. The risk was not well understood at the executive level; therefore, to support the prioritization
process, the company’s human rights manager provided a fact sheet to educate the risk committee prior
to the meeting. The expert also attended the meeting to answer any questions and provide additional
commentary as needed. The fact sheet included the following relevant information:
• The voluntary commitments the company made in relation to human rights (e.g., UN Global Compact
signatory)
• The company's requirement to assess and monitor supply chain activities for human rights violations for
approximately USD$120 million of the company’s contracts
• Customers accounting for 5% of revenue expressed human rights-related concerns in recent surveys
• Some institutional investors who comprise 20% of the company’s market capitalization raised changes in
the regulatory landscape as a major concern, for example the UK Modern Slavery Act
The resulting prioritization led to the addition of human rights risk on the risk inventory and specific roles
and initiatives established for managing this risk across the entity’s global operations and supply chain.

Managing bias
When identifying, assessing and prioritizing ESG-related risks, it is important to
identify and challenge bias. In any given entity, it is not unusual to find evidence Guidance
of dominant personalities that drive certain positions or opinions; overreliance on
numeric metrics, financial performance or historical data for decision-making; Identify and
anchoring to a particular risk event outcome or response; disproportionate challenge
weighting of recent events or short-term financial risks; or a tendency either organizational
toward risk avoidance or risk taking. bias against
It is critical to identify and challenge these biases to support better decision- ESG issues
making. Table 3b.13 provides examples of types of bias relevant for ESG in ERM.

Table 3b.13: Types of bias that can impact ESG in ERM

Type Description
Availability People tend to think events are more likely to occur if they have recently heard of them happening. Thus, people
bias overestimate the risk of death from tornadoes, cancer or accidents and underestimate the risk from asthma or
diabetes. This is because tornadoes, cancer and accidents get a lot of press and movie coverage.
54
Confirmation People tend to emphasize data that confirms their established beliefs or ideas and to discount information that
bias conflicts with their beliefs. People also fall for the “false-consensus effect,” assuming that others share their
world view. For example, if they believe in global warming, they expect that most people agree. Yet those who
question its existence also believe they hold the mainstream opinion.
55
Groupthink Groups can make faulty decisions because group pressures sometimes lead to a deterioration of mental efficiency,
bias reality testing and moral judgment. A group is especially vulnerable to groupthink when its members are similar in
56
background, insulated from outside opinions and there are no clear rules for decision-making.
Illusion of People find comfort believing they can control the world around them, even when they cannot. For example, an
57
control organization may believe it is mitigating climate-related risk by accounting for and reducing GHG emissions and
energy use.
Overconfidence People, especially specialists and experts, overestimate how much they know. Compounding the overconfidence
effect effect is the tendency to underestimate the time and costs of projects. 58
Status quo bias In choosing among alternatives, individuals display a bias toward the status quo. ESG-related risks are often new
and emerging, or unexpected; therefore, individuals are less likely to identify them.
59

Enterprise Risk Management | Applying enterprise risk management to environmental, social and governance-related risks • October 2018 65