Physical — acute
Event-driven: storms, floods, drought, heatwaves.
UK SRS S2 Appendix ASoftware · climate risk assessment, step by step
Climate risk assessment software: the steps, and what each must produce
Climate risk assessment software works out which climate hazards could reach each site and asset, how exposed and vulnerable each one is, and how those risks hold up under different scenarios.
This page walks the assessment step by step, names the UK data and rules behind each step, and gives the questions to put to any vendor; it ranks no product.
The assessment
What are the steps of a climate risk assessment? Six, from hazard to action
The IPCC frames climate risk as what results when climate-related hazards meet the exposure and vulnerability of the system affected, in its Sixth Assessment Report.
A good tool keeps those three apart, because a site can be exposed to a hazard without being vulnerable to it, and a single blended score hides which one to fix.
ISO 14091:2021 gives guidelines for the process, from screening assessments to impact chains, for organisations of any size.
The disclosure that follows is judged on climate risk software, which sets out the UK SRS S2 outputs a tool must produce.
- 1
Hazard
Flood, heat, drought, storm; policy, market and technology change.
- 2
Exposure
Which sites, assets, suppliers and people sit in harm’s way.
- 3
Vulnerability
How badly each would be affected, and how well it could cope.
- 4
Risk
Classed as physical or transition, with a time horizon.
- 5
Scenarios
How the risks change under different climate and policy futures.
- 6
Action
Adaptation, resilience and the disclosure that follows.
Steps one to three
What does each of hazard, exposure and vulnerability mean? Three different fields
The IPCC’s glossary defines a hazard as the potential occurrence of a natural or human-induced physical event or trend that may cause loss or damage.
It defines exposure as the presence of people, livelihoods, assets or ecosystems in places and settings that could be adversely affected.
In AR6, risk refers to the potential for adverse consequences only, so upside belongs in a separate register of opportunities.
For a UK site, the hazard data usually starts from the Met Office’s UKCP18 projections and the Environment Agency’s long-term flood risk service, which rates an area rather than a single property.
Read the data caveats
A flood rating for an area is a screening input, not a property survey; a tool should show the resolution of every dataset it uses.
Ask which emissions scenario and time slice sit behind a projected hazard, because the same site can rate differently for the 2030s and the 2070s.
The three ingredientsExplore
The three ingredients
Hazard
The potential occurrence of a physical event or trend that may cause loss or damage.
The three ingredients
Exposure
The presence of people, assets or ecosystems in places that could be adversely affected.
The three ingredients
Vulnerability
How badly the exposed thing would be affected — the third ingredient of risk.
Step four
How must a risk be classed for UK SRS S2? Physical or transition, with a horizon
UK SRS S2 asks a company to explain, for each climate-related risk, whether it is physical or transition, and over which time horizon it could take effect, under ¶10 of the standard.
The company defines short, medium and long term itself, linked to its own planning horizons.
Paragraph 29 then asks for the amount and percentage of assets or business activities vulnerable to physical risk, and separately to transition risk, so the tool must hold the threshold that made an asset “vulnerable”.
For listed companies in UKLR 6, 14, 15, 16 and 22, S2 applies on a comply-or-explain basis for periods beginning on or after 1 January 2027, under PS26/19.
One climate
risk
risk
Physical — chronic
Longer-term shifts in temperature, precipitation, sea level.
UK SRS S2 Appendix ATransition
Policy, legal, technology, market and reputational risks.
UK SRS S2 Appendix AStep five
How advanced must the scenario analysis be? Work it out from two answers
UK SRS S2 asks for an approach to scenario analysis commensurate with a company’s circumstances, weighing its exposure and its skills, capabilities and resources, under ¶B2.
A highly exposed company may start with qualitative narratives but would build its capability and move to a more advanced quantitative approach, under ¶B17.
The scenario analysis can follow the strategic planning cycle, for example every three to five years, but the resilience assessment is updated at each reporting date, under ¶B18.
Reference scenario sets include the NGFS scenarios, and the TCFD’s 2020 guidance remains useful background from a disbanded body.
Which scenario-analysis approach fits you?
Two questions; the answer quotes the standard, not a vendor.
Nothing is stored or sent.
Public bodies and utilities
Who reports climate risk to government? Mostly by invitation
ARP4 closed
31 Dec 2024Defra guidance summaryARP5
Late 2026–2029Anticipated, not startedNational assessment
Every 5 yearsClimate Change Act 2008 s.56Company duty
None generalListed: S2 comply or explainThe Climate Change Act 2008 lets the government direct public bodies and statutory undertakers to report on climate risks and adaptation, and Defra’s guidance says the power has been voluntary since the first round.
The fourth round closed on 31 December 2024, and its published reports from energy networks, water companies and others are a useful benchmark for what an assessment covers.
Defra expects the fifth round to start in late 2026 and run until late 2029, and suggests new reporters cover risks to physical assets, staff, supply and demand, finance and business processes.
The national picture sits in the five-yearly Climate Change Risk Assessment under section 56.
Adaptation reportingExplore
Adaptation reporting
The power
To direct public-function bodies and statutory undertakers to report.
Adaptation reporting
Voluntary
Used as a direction in round 1 only; voluntary since.
Platforms, in their own words
Which platforms describe climate risk assessment? Three, alphabetically
Three platforms in this site’s registry describe climate risk or scenario work in their own words, and each brings it alongside carbon accounting and disclosure in one place.
Specialist physical-risk data providers that are not in the registry are not listed here, which says nothing about them.
Every platform’s claims on ISSB and UK SRS are compared on IFRS and UK SRS software compared.
| Platform | What its own site says |
|---|---|
| Deepki | “Deepki centralizes your sustainability data, strategy and operations in one place so you can act on carbon, climate risk, and finance” |
| Net Zero Now | Master TCFD / ISSB Reporting to Illuminate Climate Risks and Strategies |
| Novata | Climate Risk & Disclosures: TCFD, IFRS S2, California SB 253 & 261, Transition & Physical Risk Scenarios |
The process standard
Is there a standard for the assessment itself? ISO 14091, as guidance
ISO 14091:2021 gives guidelines for assessing the risks related to the potential impacts of climate change, for present and future risks.
ISO’s announcement says it covers screening assessments and impact chains, allowing qualitative and quantitative analysis.
It is guidance, not a certifiable management-system standard, so a vendor can follow it but no product is “ISO 14091 certified”.
An impact chain — hazard, through exposure and vulnerability, to a consequence for the business — is a useful structure to ask any tool to show.
ISO 14091:2021Explore
ISO 14091:2021
Guidelines
For assessing risks from the potential impacts of climate change.
ISO 14091:2021
Vulnerability
How to understand it, and build a sound risk assessment.
ISO 14091:2021
Screening and impact chains
Qualitative and quantitative analysis.
The tests before you sign
How do you test a climate risk tool? Eight questions, each tied to a source
Each question beside this names the paragraph or source it comes from and what a passing answer looks like.
Run them on your own site list, because a demonstration portfolio never includes the warehouse on a floodplain or the supplier you cannot locate.
This site has tested no products
Nothing on this page is a rating, ranking or recommendation of any product.
Climate risk assessment demo questions · tick the ones you need
The pass tests are our reading of the cited provisions.
Nothing you tick is stored or sent.
Climate risk assessment software, in one sentence
A climate risk is a hazard meeting an exposed, vulnerable asset, and the software that keeps those three apart shows you which one to fix.
Takeaways
What to take from this page
| The fact | What to do |
|---|---|
| The IPCC frames risk as hazard, exposure and vulnerability | Ask for three fields per site, each with its data source |
| UK SRS S2 classes every risk as physical or transition | Make the class and the horizon mandatory on the risk register |
| Quantitative analysis is expected of exposed, resourced companies | Use the approach finder before choosing a tool’s depth |
| The resilience assessment is updated every reporting date | Plan for an annual update even if scenarios run every few years |
Start with the approach finder, then take the demo questions to vendors.
Frequently asked
Climate risk assessment software, answered
What is climate risk assessment software?
Software that works out which climate-related hazards could affect an organisation’s sites, assets and supply chain, how exposed and vulnerable each one is, and how risks change under different climate and policy scenarios.
Its outputs feed adaptation plans and disclosures such as UK SRS S2.
What are the steps of a climate risk assessment?
Identify the hazards (flood, heat, drought, storms, and policy or market changes for transition risk); map exposure (which sites and assets are where); judge vulnerability (how badly each would be affected); combine them into risks with time horizons; test resilience under scenarios; then decide actions.
The IPCC frames climate risk as the interaction of hazard, exposure and vulnerability, and ISO 14091 gives guidance on the process.
Is a climate risk assessment mandatory in the UK?
Not as a general duty.
Listed companies in UKLR 6, 14, 15, 16 and 22 report against UK SRS S2 on a comply-or-explain basis for periods beginning on or after 1 January 2027, under FCA PS26/19, and S2 asks for climate risks and resilience.
The Adaptation Reporting Power lets the government direct public bodies and statutory undertakers to report, but Defra says it has been voluntary since the first round.
Does UK SRS S2 require quantitative scenario analysis?
It depends on the company. ¶B2 asks for an approach commensurate with the company’s circumstances, weighing its exposure and its skills and resources. ¶B17 says a highly exposed company may start with qualitative narratives but would build capability and move to a more advanced quantitative approach.
How often must a climate risk assessment be repeated?
Under UK SRS S2 ¶B18 the scenario analysis can follow the strategic planning cycle, for example every three to five years, but the resilience assessment is updated at each reporting date.
Many organisations refresh the hazard data annually because the projections and sites change.
What is the difference between climate risk software and climate risk assessment software?
They overlap.
On this site, climate risk software is judged against the outputs UK SRS S2 asks for; climate risk assessment software is about the assessment process itself — hazard, exposure, vulnerability, scenarios — and the data behind each step.
What UK climate data should a tool use?
For UK sites, the Met Office’s UKCP18 projections are the national climate baseline, and the Environment Agency’s long-term flood risk service gives flood risk for an area rather than a specific property.
Ask any tool which projection set, scenario and time horizon sit behind each rating.
Is there a standard for climate risk assessment?
ISO 14091:2021 gives guidelines on vulnerability, impacts and risk assessment for adaptation, for any organisation, using screening assessments and impact chains. It is guidance, not a certifiable requirement.
What is the Adaptation Reporting Power?
A power in the Climate Change Act 2008 for the government to ask public bodies and statutory undertakers, such as energy and water companies, to report on climate risks and adaptation.
Defra says the fourth round closed on 31 December 2024, and the fifth is expected to start in late 2026 and run to late 2029.
Do small businesses need climate risk assessment software?
Rarely.
A small business with a handful of sites can check flood risk on the Environment Agency service and record risks in a spreadsheet.
Software earns its place with many sites, physical assets in exposed places, or disclosure duties that need consistent figures year on year.
Has this site tested any climate risk assessment software?
No. The page is built from UK SRS S2, the IPCC, ISO 14091 and government guidance, and the vendor table quotes what each vendor says about itself, in alphabetical order.
Sources
Primary sources
Every rule and definition on this page traces to the standard, report or guidance listed here.
Checked against 16 sources fromIPCCISODepartment for Business and TradeFinancial Conduct AuthorityIFRS FoundationMet Office
- IPCCAR6 WGIII Annex II, §A.II.7 The Concept of Risk
Risk from the interaction of hazards with exposure and vulnerability.
- IPCCAR6 WGII Annex II: Glossary
The definitions of hazard, exposure and impacts.
- ISOISO 14091:2021 Adaptation to climate change — vulnerability, impacts and risk assessment
Guidelines for present and future climate risk, for any organisation.
- ISOAssessing the risk of climate change (17 February 2021)
Screening assessments and impact chains, qualitative and quantitative.
- Department for Business and TradeUK SRS S2 Climate-related Disclosures (PDF), ¶10, ¶29 and Appendix A
Physical or transition, time horizons, and the vulnerable-asset metrics.
- Department for Business and TradeUK SRS S2, Appendix B ¶¶B1–B18
Scenario analysis commensurate with circumstances; annual resilience assessment.
- Department for Business and TradeUK Sustainability Reporting Standards S1 and S2
Published 25 February 2026 for voluntary use.
- Financial Conduct AuthorityPS26/19 — final rules on UK SRS reporting by listed companies
Comply or explain for UKLR 6, 14, 15, 16 and 22, periods from 1 January 2027.
- IFRS FoundationIFRS S2 Climate-related Disclosures
The international text UK SRS S2 is based on.
- Met OfficeUK Climate Projections (UKCP18)
Climate projections for the UK, the national hazard baseline.
- Environment AgencyCheck your long term flood risk
Flood risk for an area, not a specific property.
- legislation.gov.ukClimate Change Act 2008, section 56
The five-yearly UK Climate Change Risk Assessment.
- DefraClimate change adaptation reporting: fourth round guidance summary (15 October 2025)
A power to direct; voluntary since round 1; ARP5 from late 2026.
- DefraClimate change adaptation reporting: fourth round reports
Published risk assessments from energy, water, transport and other sectors.
- Task Force on Climate-related Financial Disclosures (FSB)Guidance on Scenario Analysis for Non-Financial Companies (October 2020)
Guidance from a disbanded body; never a requirement.
- Network for Greening the Financial SystemNGFS Scenarios Portal
A reference set of transition and physical-risk scenarios.