Page 613 - COSO Guidance

3. Performance for ESG-related risks

The following questions can help identify ESG bias in an organization:

• Do dominant personalities or positions of power focus the attention on specific risks or dismiss risks that
are not ESG-related?
• Does management over rely on numeric evidence in prioritizing risks, overlooking ESG-related impacts
and dependencies that are not easily quantified?

• Does management disregard contrary information, including that related to emerging or unfamiliar
ESG-related issues?
• Does management use a short- to medium-term time horizon (18 to 36 months) that may not effectively
capture potentially slower-moving ESG-related risks?
• Does management have a tendency for risk avoidance or risk taking, which could impact the treatment of
ESG issues?
• Is management overconfident about the controls in place to manage risk,which could omit

considerations for more severe but plausible scenarios for ESG issues?

A robust ERM process can help counteract bias. Beyond becoming aware, the following are some short-term
strategies to help overcome these biases:
• Practice open-mindedness: Improve judgment and challenge the status quo by eliminating the influence of
stereotypes, idiosyncratic associations and irrelevant factors.
60
• Develop cross-functional teams and obtain objective informed inputs: Seek advice from both internal
and external experts to obtain diverse perspectives on individual issues.
61
• Quantify risks and use common language: Identify methods for communicating with cross-functional
teams using a common language and consistent metrics for assessing risks. 62
• Provide reference points: Ask questions using a frame of reference that can be well understood. For
example, instead of asking colleagues to identify potential environmental risks, ask them to answer a question
such as, “How will our supply chain be impacted by severe flooding or hurricanes?” or “What would be the
costs to our supply chain if we can no longer access our facilities?”
63

66 Enterprise Risk Management | Applying enterprise risk management to environmental, social and governance-related risks • October 2018