how do I integrate sustainability risks into our risk management

ESG risks belong in the existing risk register, not in a separate document

The question "how do we integrate sustainability risks into our risk management" comes back to you in questionnaires as a simple yes/no question, but the answer behind it is a process: ESG risks (climate, human rights in the supply chain, governance) are included as part of existing risk management, not as a separate sustainability trajectory alongside it. Anyone who can show that there is one risk register in which ESG matters sit alongside financial and operational risks — with owner, impact and control measure per risk — can answer the question with yes. Anyone who mentions ESG risks only in a separate sustainability report without linking it to risk management cannot.

For the basic module that smaller suppliers often face, the bar is lower than for full reporting: it is about a recognizable, concise description of the main risks and what you do about them, not an elaborated risk matrix with quantification. Governance risks often touch on topics that come up elsewhere in the questionnaire — whether there is a procedure for reporting conflicts of interest for example, belongs just as much to ESG risk management as to governance questions separately. If you have not yet documented that process, then "no" with a brief explanation is the honest answer — not "yes" because it happens somewhere implicitly.

What this is based on: the basic module of EFRAG VSME

The basic module of the voluntary EFRAG VSME standard for non-listed SMEs asks for a concise description of practices, policies and future initiatives in the field of ESG, which in practice amounts to integration into risk management rather than a separate trajectory. Directive (EU) 2022/2464 (CSRD) is the background to this for larger companies in the supply chain, and explains why smaller suppliers are increasingly asked this question by their customers: those customers must themselves report on their supply chain. If you also read something in the questionnaire about a reporting procedure for misconduct, you can tick that separately via how you complete the question about a whistleblower scheme — that is a governance component that is often asked separately from the ESG risk block, but is substantively related to it.