The CFO and ESG, match made in heaven

TL;DR

• Less CSRD reporting doesn't mean less risk: legal obligations may shrink but energy, supply chain and climate risks remain fully in place

• ESG exposure can de divided into five risk categories (physical, transition, value chain, social, governance) and each should be quantified in euros

• Sustainability risk management belongs with the CFO, who already has the mandate to translate scattered data into financial decisions

• Add ESG risks with financial impact to the existing risk register and operational KPIs to monthly reporting

Introduction

Sustainability is becoming more and more a CFO responsibility. The risks behind it, energy dependence, raw material scarcity, a supplier falling away, feed directly into margin, cashflow and investment decisions. A relaxed reporting requirement doesn't change that. It just gives room to look at the financial value of sustainability.

In practice, we see that this relaxation sometimes leads to the opposite conclusion. Anyone who always saw sustainability as a legal obligation, not unreasonably, feels the 2025 Omnibus simplification as a relief. Finally rid of that reporting burden. That's understandable. But the risks Europe was trying to make transparent with it haven't gone away.

Does less CSRD reporting also mean less risk?

No. Fewer companies falling under the CSRD only means fewer companies are legally required to document and publish their risks. Not that the underlying risks get smaller.

A company that no longer has to produce a CSRD report isn't suddenly immune to rising energy prices. Or to a disrupted supply chain. Or to a client who wants to see your CO2 footprint before doing business with you. Banks, insurers, major clients and public procurers keep asking those questions, reporting obligation or not. The difference between a reporting obligation and a financial risk is exactly where this usually goes wrong: Europe can scrap the first. The second doesn't disappear through a change in legislation. Keeping sight of those risks remains important.

An example everyone knows and feels by now: the energy crisis

Energy is where sustainability and financial risk are most tangible for everyone.

The difference is often bigger than expected. Today, charging at home costs roughly 5 to 6 euros per 100 kilometers. Driving on petrol or diesel currently costs 13 to 14 euros per 100 kilometers, at pump prices of more than 2 euros per liter. That's not a bit more expensive. That's more than double for anyone who sticks with fossil fuel. Scale that math up to a fleet and it gets interesting. A fleet of twenty vehicles covers 600,000 kilometers a year combined. At that difference, the impact runs into six figures a year, before maintenance or taxation are even factored in. That's not a stand-alone sustainability figure. That's a real hit on the P&L.

The same logic applies to energy use in production and heating. Since the energy crisis, we've seen how fast gas prices can double. A company that knows its energy intensity, how much it consumes per unit produced, how dependent it is on a single energy source, can calculate in advance what the next price shock will do to its margin. A company that doesn't know this finds out on the invoice. By which point it's already too late.

Which ESG risks should a CFO actually watch?

Five categories. For each one, the same question applies: what does this cost us if it goes wrong?

* Physical climate risks. Flooding, heat or storms can shut down a production site, a construction site or a distribution center. Repair costs, lost production, higher insurance premiums as a result.

* Transition risks. Energy, technology, regulation and demand shift. Energy-intensive companies feel this first, in higher operating costs or a sudden need to invest.

* Value chain risks. Raw material scarcity, geopolitical tension, dependence on a single supplier. Result: production interruptions, higher purchase prices, more working capital needed.

* Social risks. Labor safety, absenteeism, staff shortages, working conditions at suppliers. An accident on site is rarely ever just a social risk. It's also delay, claims and lost productivity for the company.

* Governance risks. Fraud, corruption, a cyber incident, weak internal controls, or a sustainability claim that doesn't hold up. Direct financial damage, plus lost trust among clients, employees and financiers. A well-substantiated "climate neutral" claim is no longer just a reputational issue. It's also a legal risk. See our blog post on EmpCo for more on that.

Which of the five weighs heaviest depends on the business model. A good risk assessment starts from where the company itself is most exposed.

This works in both directions. A company with high energy intensity doesn't just emit a lot of CO2, it's also more financially exposed to the next price shock. Poor working conditions affect employees first. But they quickly carry through into lost production and liability for the company. If you only measure your impact on the world, and not the impact on your own numbers, you're missing half the story. And the other way around. Double materiality. Ring a bell?

How do you translate an ESG risk into euros?

By not leaving the risk sitting in a separate sustainability matrix. Give it a place in a risk register, with an impact expressed in revenue, EBITDA or cashflow.

It doesn't need to be precise to the euro. A simple rule of thumb often does the job: for example, bracket the impact as less than 1%, 1 to 5%, or more than 5% of EBITDA. As long as risks only sit in a sustainability report as "high", "medium" or "low", they stay too vague for the business and for management to act on. As we highlighted before in our Trends article: the value lies in translating sustainability data into financial impact.

When is a sustainability investment worth it?

When the TCO (total cost of ownership) comes out lower than the alternative. Not when the sticker price is the lowest.

The purchase price of an electric vehicle, a heat pump or a solar installation says little about the ultimate cost. What matters is the sum of purchase, maintenance, energy use, technical lifespan and residual value. Weighed against the alternative. Like electric driving above: the purchase looks pricier, but among other things the cost per kilometer is structurally lower.

Three questions determine whether such an investment is financially sound:

* What's the payback period, based on realistic energy prices?

* What does each avoided ton of CO2 cost?

* What's the right timing?

That's a classic investment assessment, applied to sustainability.

Why should this sit with the CFO?

Because the CFO already has the mandate and the reflex to quantify risk, run the numbers on scenarios, and allocate capital.

Energy use sits with the technical department. Personnel figures with HR. Supplier information with procurement. None of them has the reflex, or the mandate, to connect that data to margin, cashflow or investment decisions. The CFO doesn't need to read energy meters. The data is already there, scattered across the organization. What's still missing is someone to pick it up and turn it into a financial story.

There's also a control role in this. The moment sustainability figures end up in a quote, a client file or a marketing claim, the same rules apply as for financial figures. The data behind it has to be correct. The claim has to be backed by numbers.

What should a CFO actually do?

Add three to five ESG-related risks to a risk register. Alongside the risks already in it, with an estimated financial impact and an owner. The more sustainability is folded into existing risk management, the more likely it is to actually get used, and to hold up regardless of political shifts.

Add a few operational indicators to monthly reporting, next to the classic figures: energy use per unit, material loss, absenteeism, fuel cost per kilometer. Also require investment proposals to include a line on energy intensity or CO2 impact, next to the classic return figures, so that trade-off happens by default. A separate sustainability budget is the first thing to go in the next round of cuts. The impact of sustainability inside an existing risk register isn't.

Who wins in the years ahead?

Not the companies with the thickest sustainability report. The companies whose CFO can say exactly what the financial impact of sustainability is on the P&L.

That's ultimately how you should define sustainability. As a set of external factors, from climate risk to geopolitical pressure, that feed directly into a company's financial performance. They affect profitability, risk profile and capital allocation. What company wouldn't want an answer to that?

Curious what that looks like for your business? Our experts are happy to help.