Podcast | Managing Climate Risk, both Acute and Chronic – with Matthew Sekol, Kimberly Roscoe and Alyse Mauro Mason

Alyse Mauro Mason: Welcome to the Board Perspectives podcast, brought to you by Protiviti, a global consulting firm where we explore numerous challenges and areas of interest for boards of directors around the world.

I am Alyse Mauro Mason, and I help lead our ESG and Sustainability practice at Protiviti. I’m joined today by two of my dear friends, Matthew Sekol from Microsoft and my Protiviti colleague Kimberly Roscoe. Matthew Sekol is a sustainability global black belt on Microsoft’s cross-industry team. He also serves on the LP Advisory Committee of Morgan Stanley’s Next Level Fund, which invests in underrepresented startups. In 2024, Matthew also released a book called The ESG Mindset, which is a guide for companies to think critically about ESG and a holistic approach to the business. He also is on the advisory board at Enzo Advisors, an ESG consultancy.

Also joining us today is Kimberly Roscoe, a senior manager at Protiviti who specialises in risk management, regulatory remediation and climate risk. Kimberly spent over a decade as a bank examiner at the Federal Reserve, obtaining her Sustainability and Climate Risk Certificate during that time, and now she gets to use those experiences to help financial services institutions and public companies improve their overall risk management and understand the upcoming existing and ever-evolving regulations related to climate risk.

Today, we’re going to talk about climate risk. We are joining you today in our personal capacity to share our experience, our expertise and insights. I have the pleasure of talking about climate risk and sustainability with both Kimberly and Matthew often, and I thought it could be a delight to bring these great people together to talk about the topic and share it with all of you.

Matthew, welcome back to the Board Perspectives podcast. We’re happy to have you.

Matthew Sekol: It’s great to be here.

Alyse Mauro Mason: Kimberly, welcome for the first time to the Board Perspectives podcast.

Kimberly Roscoe: Thank you.

Alyse Mauro Mason: Matthew, to help ground us in our climate risk conversation today, I’m going to use a few sentences from your book, The ESG Mindset, and what you say is, climate risk means the company understands its transient and long-term challenges around climate change and constructs adaptation plans accordingly. When we talk about climate risk, there are two common types: acute and chronic. Can you describe them and how companies should or can think across these two elements from a short-term and a long-term perspective?

Matthew Sekol: Acute and chronic risk, I picked it up from the TCFD. This is their way of framing these climate risks. Acute risks are the extreme weather events that happen in the short term. Chronic risks are the long-term, systemic changes that happen around our climate. For example, if I’m a coffee company and I’m sitting at the headquarters of the coffee company, I might think, “There’s a hurricane coming. Is my coffee shipment going to be on time to my stores?” On the other hand, I might be thinking, “Coffee only grows between these certain latitudes and longitudes. What are the long-term systemic risks? Is it drought? Is there a mold that’s infecting coffee? What is the climate impact on the farmers in that area?” That is more the long-term chronic risk. Companies need to think about it in these two ways.

Alyse Mauro Mason: I remember you mentioning something around acute climate risks impacting 70% of business sectors globally. That’s a pretty remarkable number.

Matthew Sekol: I can’t remember where that stat came from, but it sounds right to me because I live in a rural area of Pennsylvania. I’ve had hurricanes flood my basement, which is an acute risk. We had wildfires here this past summer, as well as extreme drought. Every company has this acute risk, and it varies. We just saw the L.A. wildfires, and we saw companies, if I remember right, like Starbucks and Hilton stepping up to help their employees when they were experiencing the wildfire damage at their homes. Companies have these issues — and it could be anything. If you’re on the coast, it could be flooding. If you’re in the Midwest, it could be tornadoes. In Canada, they’ve had extreme cold and had to shut down schools. It could be anything depending on where you operate in the physical world.

Alyse Mauro Mason: It’s becoming more frequent in your backyard than ever before. People tend to talk about the weather, and now it’s these extreme weather events we’re talking about. We’re experiencing more than ever what climate risk impacts have on people, the planet and our businesses.

When we think about the impact and the implementation, Kimberly, in what ways can institutions and businesses enhance their strategies to be more climate-aware, and what roles do external training and evaluation play in this process?

Kimberly Roscoe: For enhancing strategies, two core pieces of strategy are, where are we, and where do we want to be? Matt just made some great comments about acute risks, things you have to incorporate into your day-to-day operations. When an institution thinks about setting strategy, they evaluate their mission, vision, objectives. They need to determine how climate plays a role and what stance they want to take.

However, you can’t set a strategy if you don’t have a current-state understanding. The first step is for companies to have a comprehensive analysis. A lot of companies do a SWOT analysis — strengths, weaknesses, opportunities, threats — and to be comprehensive, climate would be a part of this. You need to evaluate your internal capabilities and your external environment: How do floods, fires, hurricanes impact your business, and how are you going to incorporate that and grow from that?

This is where you can bring in external training as a first step, or evaluation — understanding the board and management’s understanding of climate risks, how they’re being incorporated today and their current analysis. You can have external training come in, teach the board, teach management, so they can perform that internal analysis. Or, depending on management’s capability, time, expertise, you can hire an external evaluation to sit down and ask, “What are your acute, your chronic, your transitional risks, even in the longer term.” You can have an external company evaluate that for you. It depends on the depth and level of understanding of management and what you want to get out of it — you figure out where you are and where you want to be. What is impacting you now, and what do you need to do to get better, to get stronger, or to mitigate those risks?

There’s another piece where strategy is — we talk about risks. There are also opportunities you can incorporate. It’s not just “How do we manage the risk?” Are there areas of climate that are opportunities? Financial services companies are looking more into, what can they finance to strengthen resilience, to strengthen climate, to move toward net zero? That’s another area where you can incorporate external training or external evaluation: How can we take our current state and develop a strategy that has a positive impact? Where can we finance things? Where can we look? Or, on the operational side, what can we do to strengthen our operations to make sure they’re resilient in the face of those climate issues or to make the adaptations ahead of time so you’re not falling victim to reactive management, but you’re doing proactive management?

Alyse Mauro Mason: Reactive, proactive. And once you get that strategy in place, once you get the external training and the understanding of where you are and where you want to go, how do boards effectively integrate climate risk management into their existing framework and into their existing processes to capture these ever more relevant risks from a climate perspective?

Kimberly Roscoe: That’s something I do a lot in risk management: You set that strategy, and risk management is the next piece. You take the strategy, you evaluate the risk. I do a lot with banks — your credit risk, your liquidity risk, your market risk, your operational risk. You determine, when you’re evaluating that, what your risk appetite is for each of those areas. You want to have low risk. You don’t want your operations going down. How do you develop metrics that tell you what’s going on? How do you develop that into your risk management, reporting how the board sees it, how management sees it, in order to manage those risks?

Alyse Mauro Mason: Kimberly, you were just talking about metrics, and data that could help support the board’s understanding and the board’s accountability, and integration of this under their entire enterprise, and what they govern. Tell me more about some of those metrics to measure climate risk impacts and opportunities that the board, one, can be evaluating and two, can potentially be accountable for from a business perspective.

Kimberly Roscoe: I always joke, my old examiner answer was always, “It depends,” and it hasn’t changed outside of being an examiner. It depends on your industry, on your business. Once you do that current-state evaluation, what are your dependencies? That’s a good metric to use. Do you have vendors that you’re dependent on? You do an evaluation of all those vendors — third-party risk management like that: How can that impact your business? Your metrics could be on risk assessments for your third parties.

You could also do geographic metrics. Concentration is a great thing to think about: either your customer concentration, your location, if you have brick and mortar, if you’re manufacturing — where those pieces are, and how are we concentrated, in what areas, and what climate impacts exist in those areas? We talked about longer-term, which is harder because transition risks can be on a much longer timeline. You could think about regulations throughout the world and where, in different places, you may end up having to change your manufacturing process, to change where you get things, and incorporate that. You determine metrics based on what it could do to your business and where you can eliminate concentrations and eliminate impacts.

Alyse Mauro Mason: Thank you for that. A lot of boards think, “What do I need to be thinking about? What should I be thinking about? What am I not thinking about?” That provided clear context.

Matthew, I want to get your thoughts on sustainability disclosures from a regulatory perspective. But before that, is there anything you want to add to what Kimberly just shared on the board side?

Matthew Sekol: This is an area where the board likely doesn’t have deep expertise. You’re probably going to have to find, and lean on, some domain expertise. Kimberly mentioned getting people in to talk to your company, to your board, about this topic. That’s so critical because even if you know enough to be dangerous, that’s not going to get you to protecting your business and finding those opportunities.

Alyse Mauro Mason: Great point. To shift into sustainability disclosures, you often write about them, you’re sharing, you’re digesting things and you’re helping people navigate this ever-evolving landscape. As you think around disclosures and what companies are and are not doing, a couple things come to mind — the California climate laws, the CSRD, the ISSB. Share more on what your thinking is there and how we can help focus people from a climate risk perspective.

Matthew Sekol: Disclosures are interesting, and I write about them quite a bit because they focus a lot on mitigation. Adaptation, which is what Kimberly was talking about earlier, is very much underfunded, which means we’re reporting our state of transition from, largely, an energy perspective and an operational perspective because carbon is the focus right now. But we’re missing this climate risk and adaptation piece entirely. When you go through 10-Ks, you might see a reactive “We think climate risk is going to be a problem. A tornado hit our facility, and we’re still recovering from that, and it’s a multiyear journey and it’s multimillions of dollars.” You see a little bit of boilerplate proactive comments, a little bit of reactive “We missed this.” But I haven’t seen a robust climate risk report from anybody yet, which surprises me because you can’t escape it no matter where you operate.

Maybe one company, like Atlassian, is famous for hybrid and remote work, and maybe they’re diffuse enough across the planet that extreme weather might impact individual employees here and there, but they’ve distributed themselves around. Most companies are not like that. They have physical assets bound by physical laws in the real world, and they can’t escape it. I don’t know why companies aren’t more focused on the reporting aspects in the disclosures on climate risk, but it seems like it’s a real miss.

Alyse Mauro Mason: Hopefully, it’s something that changes as we continue to go down this climate risk path, and they can’t be ignored. These risks are happening almost daily, it feels like, and with physical assets comes liability, comes insurance. What are your thoughts? What have you been thinking about from insurance models and how companies are leaning on insurance in general, and areas where insurance has exited the market?

Matthew Sekol: I talk to insurers sometimes, and I’ve heard that they need to update their climate models for extreme weather. But it’s difficult because especially here in the U.S., in some states, you can only look backward. You can’t do this predictive analysis because it’s tied with the rate setting, and it can be very difficult for them to be proactive. From a company perspective, though, I suspect about adaptation that companies are leaning on their insurance policies, and they’re saying, “We have physical assets that we’re protecting with an insurance policy. If the company burns down because of a wildfire or it’s torn up in a tornado, we have insurance.”

But that’s not a sustainable model, because we haven’t figured out yet how to sustain an insurance model in this new world of extreme weather. Insurers largely haven’t exited the commercial real estate market, but they have exited the residential market, and every company has employees that can’t get insurance in specific regions now. It’s this big mess of, how do we protect ourselves, and is insurance enough? My belief is that it isn’t. There are adaptation measures you need to take around your physical assets to help protect them from the specific things you think have a high propensity in your area. Not everything — just what you think might happen. And here are great companies that can help, like Kimberly was talking about — that could advise you on that.

Alyse Mauro Mason: The adaptation is such a key piece. That’s what we’re seeing as companies rethink risk models. And insurance companies, what can they and can they not insure? When you think about industries that are more vulnerable to climate risk, what comes to mind for you, and what role do those key stakeholders within those industries play?

Matthew Sekol: There are some specific industries in which it’s almost like you’re playing offense and defense, depending on your industry. If I’m an electrical utility and I have transmission lines, I’m probably going on the offense to make sure that in a drought, they’re not sparking a wildfire, because that represents litigation risk — in some places, severe litigation risk, as we’ve seen in California and Hawaii. If I’m a manufacturing company or a retailer and I rely heavily on a value chain, I might be going more on the defense: How am I making sure I’m diversifying my supplier locations enough to make sure I get a steady stream of the inventory for my shelves, or if I’m making a product, whatever it is. There are all sorts of very specific industry perspectives that need to be formed.

One that Kimberly called out earlier that is interesting is financial services, because they have two sides to this. From a carbon-emissions perspective, for financial services firms, it sits with their emissions. Putting aside their investments, it sits with their emissions in their facilities, which means they have people who are physically sitting in offices. How are they protecting, one, those offices, and two, their employees in the communities around the cities in which they likely live?

Then there’s this entire other side: “How do we fund an adaptation measure at a California hotel?” I need to fund an adaptation measure because I invest in that hotel and I don’t want it to burn down, because that represents a significant loss. How can I invest in a project that hires a landscaper to plant more fire-resistant plants around the area and do different things with the land to protect that asset?

Healthcare is different with climate risk, but it’s also acute and chronic. It’s “What is most likely to hit in the next year, and how do I deal with it in my ER, and what are the diseases that are going to come in 10 to 20 years with the long-term climate changes in my area? Every industry has some sort of intersection they need to think about here.

Alyse Mauro Mason: That’s such a great point. Coming back to what Kimberly said earlier as a former examiner, Kimberly, I’d love to hear what you’re thinking from a vulnerability perspective in the financial services industry in particular.

Kimberly Roscoe: We talked about where people are sitting, where their physical locations are. But a big piece of financial services is loans — the assets underlying your loans, the collateral. The first thing I remember getting into when they talked about climate when I was back at the Fed was about Napa Valley. Seven years ago, there were a lot of fires there, and insurance companies started questioning if they would insure that area. That was the first foray into impact on financial services: Can you get insurance for collateral? If it burns down and you can’t get insurance, are you going to lend to them? That’s a crucial conversation when the entirety of your business is based off lending to people.

The other piece you’re starting to see more in the international banks, but in banking in general, is commitment toward funding sustainability — finding a portfolio that goes after sustainability, that supports new industries, that support sustainable areas. That’s a new piece in finance. Those are areas when you think about financial institutions. The physical aspect is one piece, but the larger aspect is, what are you financing? What is your collateral? What is the path forward?

Another way to think about that is, I’m not trying to tell banks to get in or out of an industry, but oil lending is a big industry, but transition risk in that area could cause that to be an interesting area to continue financing. How do you finance that? How do you integrate? How do you make sure you’re not financing an industry that goes away or you’re financing new industries that could be great opportunities, great growth drivers? That’s from the financial services industry. There’s so much there. You can do more than just “What does our company do?” It’s “What companies do you support? Where do you want to put those finances? Where do you want to deploy your assets when you take deposits in? Where are you giving out those assets?”

Alyse Mauro Mason: It’s thinking through responsible transition, and transition plans and business resilience and some of these bigger topics that somehow get swallowed in some of the other elements we’re talking about today.

I’m coming back to something, Matthew, you talked about in your book: how environmental cannot be split from social and governance, as it brings important context and nuance and strategic planning that could also be overlooked if you separate things. In the last five years, there have been these great fill-in-the-blanks. We could be entering a new period of great reframing, great redirection, great evolution. Who knows where we’re heading, but there will be changes on the horizon. Do you have that same thinking when you’re thinking about climate risk and sustainability?

Matthew Sekol: There’s a chapter in my book around the interconnected nature of the acronym, which is why I really like ESG, even though it’s fallen out of favor in some circles, because it’s the most simple way to connect those three things together — and they are connected. I once met with a mining company that was talking about climate risk, and I said to them, “If your mine is hit with something like flooding, obviously, you’re going to be down. But do you think it is going to be different if a wildfire rips through just because it’s underground? If your employees can’t get to the office, get to the mine, or if their community is destroyed, your mine’s going to be down. Are you just looking at the physical assets, or are you considering the people and the stakeholders who are doing this?”

Kimberly is right to question some of these industries that might not be around. They could be in your value chain, and how are you supporting a transition, but also, how are you ensuring that those stakeholders are getting trained up if there’s something new? Is that on you, or is that on the supplier? Hawaii had a great example of this when they shut off the last coal-fired plant. I remember reading they had done the training of the workers at the plant for renewables. That is what we should be doing. All these things are interconnected, and governance plays a role — and where it plays a role is, are you paying attention to these things, how they’re interconnected, and doing the things?

Alyse Mauro Mason: Resources are hard to come by, whether it’s monetary, and members of a team that can actually execute against this work. We’d be remiss if we didn’t talk about Microsoft technology and AI and how technology in particular can play a role in helping identify and mitigate and potentially help with adaptation plans for climate risk. What are you thinking there? What’s happening for you when it comes to incorporating technology and AI into this area?

Matthew Sekol: Technology has a role to play, and there are two sides to it. One is, clearly, satellite imagery, and doing planetary-scale analysis of weather patterns in the short term and the long term is one way to help protect against the risk of physical assets getting hit. It’s even more nuanced. Microsoft published this book called AI for Good, and one of the examples is using AI to combine multi-levels of granularity on the satellite images so they can be consistently checked for different things. Satellites have different types of images they do. AI can help you try to put things together, like assessing damage before and after an event. Tackling these problems requires a board and a management team to recognise these issues, and in some cases, they don’t.

Data is going to accelerate some of the progress we’re going to see over the next decade — not necessarily for mitigation, but also for adaptation. Companies are operating in a world that is not what it used to be — even five years ago, extreme weather events hit the global north, shifting social sentiment, polarisation. There is no shortage of craziness that boards and management teams need to deal with.

I don’t think we’re sitting on technology today that is built for that, which means one of two things: Either your application, your back-office tools, need to have that integration, or you need to pull it out of the data and start matching it up and looking at it yourself in a data lake house. You’ve seen what I’ve written about it. Putting this data together is going to help companies protect themselves against risk and do what Kimberly was saying earlier: find those new opportunities.

Alyse Mauro Mason: By building that data lake, that data estate, it’s going to open doors for other use cases. That’s where you focus on a specific use case and you build something that could enable other use cases. If sustainability and climate risk happen to be one of those use cases that makes your business more resilient, more responsible, everybody wins. Technology and AI certainly have a place here, and it’s homing in on what is going to be most efficient and effective for your business.

Matthew and Kimberly, to close out our conversation today, we’d love to come back to you to share with the audience three key takeaways we hope everybody leaves with today.

Kimberly Roscoe: My first one is funny coming from an ex-regulator: Climate risk management should not be dependent on regulation. Climate risk management is good risk management, full stop. You shouldn’t have to have a regulation come in. It should not be dictating it. Are you managing your risks appropriately? If you’re not thinking about climate, the answer is, you’re not managing your risks appropriately.

Another one is, the board is ultimately responsible. For all companies that have boards, they need to hold management accountable for incorporating climate risk into your existing risk management framework. Climate risk is a transverse risk — it hits multiple areas — so it should be incorporated, and boards need to hold management accountable for that.

The last piece that needs to be done is, the board needs to set the tone at the top. They need to set the tone that ensures that their strategies are comprehensive and incorporate climate awareness, climate risk, climate opportunities, so that it’s pervasive through an entire industry or an entire organisation that the board has said, “This is how we’re going to approach it,” and it filters down from there.

Alyse Mauro Mason: Thank you, Kimberly. Matthew, is there anything you’d like to add to those three key takeaways?

Matthew Sekol: Those were phenomenal, and I couldn’t agree with the first one more. And as you look to build your strategy, as you look to build the use cases out, make sure you’re making a friend with somebody in IT because you are going to need data to both start with metrics and end with the outcomes of those metrics.

Alyse Mauro Mason: What a fantastic way to close our conversation today. Thank you for being loyal listeners. We hope you enjoyed our discussion about climate risk directly from the author of The ESG Mindset and a Microsoft sustainability leader — and my dear friend — Matthew Sekol, and with my esteemed friend and Protiviti colleague Kimberly Roscoe. If you have any questions, please reach out to us at Protiviti and our friends at Microsoft. Until next time, take good care.