The Carbon Border Adjustment Mechanism (CBAM)
14 min
Level
In this article, we break down what the EU CBAM is, how it works, and what businesses need to do to comply.
ESG / CSR
Industries
MEASURE
ACT
COMFORM
Impacts, Risks, and Opportunities (IRO) for CSRD Reporting
Level
By Kara Anderson, UK Copywriter, on 13/02/2025
Updated by Kara Anderson, on 27/05/2026
The Corporate Sustainability Reporting Directive (CSRD) has fundamentally transformed how businesses approach sustainability. At the heart of this shift is the Impacts, Risks, and Opportunities (IRO) framework - a mandate that requires companies to look both outward at their societal footprint and inward at their financial resilience.
IROs act as the filter for your entire sustainability report. By systematically mapping out where your business impacts the world and where sustainability trends create commercial risks and opportunities, you can cut through the noise. This framework ensures your business prioritises and discloses exactly what matters under the European Sustainability Reporting Standards (ESRS).
In this article, we'll cover:
What are IROs?
The Role of Double Materiality
Step-by-Step Identification & Assessment
CSRD Disclosure Requirements (IRO-1 & IRO-2)
Challenges & Best Practices
What are Impacts, Risks, and Opportunities (IROs)?
The Impacts, Risks, and Opportunities (IROs) framework is the operational backbone of sustainability reporting under the Corporate Sustainability Reporting Directive (CSRD). Rather than treating sustainability as a vague corporate social responsibility exercise, the IRO framework forces companies to categorise and quantify how sustainability issues affect both the wider world and their own financial bottom line.
Under the European Sustainability Reporting Standards (ESRS), these three distinct lenses are defined as:
Impacts (Inside-Out)
The positive or negative effects a company has on the environment and society, including emissions, biodiversity loss, or workforce well-being outcomes.
Risks (Outside-In)
Sustainability-related financial threats that may disrupt business performance through regulation, climate events, supply chain issues, or market shifts.
Opportunities (Outside-In)
Strategic and financial advantages gained through sustainability initiatives, such as efficiency savings, green market access, or innovation leadership.
The role of IROs in double materiality
Under CSRD, companies cannot simply pick and choose what they want to report. They must pass all potential sustainability topics through a rigorous double materiality assessment to determine what is truly significant to their business.
IROs act as the connective tissue between the two pillars of a double materiality assessment, linking company impacts with financial risks and opportunities.
Impact Materiality
Driven by “I” for Impacts
Focuses on how the company’s operations and value chain affect people and the planet, such as pollution, resource depletion, or human rights abuses.
Inside-Out
Financial Materiality
Driven by “R” and “O” for Risks and Opportunities
Focuses on how environmental or social factors affect the company’s value creation, cash flows, and long-term viability, including carbon taxes, reputational damage, or green financing advantages.
Outside-In
Ultimately, IROs dictate the boundaries of your entire CSRD report. By systematically analysing where your company has an impact, where it faces financial risk, and where it can capture green opportunities, you establish a clear, auditor-ready roadmap. This roadmap determines exactly which ESRS topical disclosures are mandatory for your business and how your final reporting must be structured.
How to identify and assess IROs
Identifying your Impacts, Risks, and Opportunities (IROs) is the critical baseline of CSRD reporting. Without a structured identification phase, companies risk missing critical vulnerabilities or wasting resources tracking immaterial data.
According to EFRAG's Materiality Assessment Implementation Guidance (IG 1), this mapping process should be broken down into three distinct operational steps:
The 3-Step IRO Identification Framework
1
Longlist Mapping
Build a broad universe of potential sustainability matters.
- Map against EFRAG’s AR 16 ESRS 1 reference list.
- Benchmark against peer disclosures and industry standards such as GRI and SASB.
- Analyse internal operational data.
2
Core Categorization
Sort issues into the three mandatory ESRS buckets.
- Impacts: Inside-out environmental and social effects.
- Risks: Outside-in financial threats.
- Opportunities: Outside-in commercial benefits.
3
Value Chain Expansion
Trace IROs beyond your immediate corporate boundaries.
- Upstream: Suppliers and raw material sourcing.
- Own Operations: Internal facilities and workforce.
- Downstream: Product logistics, use phase, and end-of-life.
Deep dive: Executing the 3 steps successfully
1
Building the Longlist
The universe of matters
Companies should avoid guessing what might be material. Instead, they should anchor the process in ESRS 1, Appendix A, AR 16, which provides a predefined taxonomy of sustainability topics, sub-topics, and sub-sub-topics.
This list should then be complemented by internal data, such as risk registers or HR metrics, peer benchmarks, and early-stage stakeholder engagement with investors, employees, and suppliers to catch blind spots before data modelling begins.
2
Classifying into the IRO Buckets
Impacts, risks, and opportunities
Once your longlist is established, separate the issues into explicit categories. A single sustainability topic will often generate multiple distinct items across the IRO framework.
💡 Example — Carbon Emissions
Impact
The company's direct greenhouse gas footprint contributing to climate change.
Risk
Financial exposure to tightening carbon tax regulations or rising energy prices.
Opportunity
Lowering operational costs by transitioning to on-site renewable energy.
3
Tracing IROs Across the Value Chain
Upstream, direct operations, and downstream
A company’s sustainability footprint rarely stops at its factory doors or office walls. Under the CSRD, IROs must be mapped across three distinct horizons.
Upstream: Assessing tier-1 and deep-tier supplier dynamics, such as human rights risks in raw material mining or scope 3 supply chain emissions.
Direct Operations: Your immediate control boundary, such as occupational health and safety at your main facilities.
Downstream: The lifecycle of your product or service, such as product energy efficiency during use or circular economy opportunities regarding disposal.
Once your IROs are fully mapped, categorised, and traced across the entire value chain, you are ready to move from identification to scoring materiality.
Close
Determining the materiality of IROs
Once your Impacts, Risks, and Opportunities are mapped, you must evaluate which ones cross the threshold into being material. Under the CSRD’s double materiality mandate, this evaluation requires two distinct scoring lenses: Severity & Likelihood for impacts, and Financial Performance & Probability for risks and opportunities.
Assessing impact materiality
The environmental and social lens
For impacts, materiality is determined by severity. Under ESRS 1, severity is assessed using three core criteria - scale, extent, and reversibility - with likelihood added only for potential future impacts.
Scale
Measures the absolute magnitude of the impact. A localised incident carries lower scale than significant emissions contributing to global climate change.
Extent
Assesses how geographically or socially widespread the impact is - from affecting a single community to disrupting an entire global supply chain.
Reversibility
Evaluates whether the environment or society can recover from the impact. Irreversible damage carries significantly greater weight.
Likelihood
Applied only to potential future impacts, measuring the probability that a future event or impact will occur.
⚠️ The ESRS Severity Rule
A negative impact is considered material based on the combined severity of its scale, extent, and non-reversibility. If an issue is highly severe, it may still qualify as material even if not every individual criterion scores highly.
Assessing risks and opportunities
The financial lens
Unlike the inside-out perspective used for impacts, financial materiality focuses on how sustainability topics influence value creation, cash flow, asset preservation, and long-term business resilience.
Financial magnitude
Measures the estimated economic effect of a risk or opportunity, including liabilities such as regulatory fines and carbon taxes, or gains such as efficiency savings and green market growth.
Probability
Evaluates the likelihood that a financial risk or opportunity will materialise over a defined reporting horizon.
Defining your reporting horizons
The ESRS requires companies to assess risks and opportunities across short-, medium-, and long-term horizons. Although common benchmarks use 1–3 years, 3–5 years, and 5+ years, these timelines should align with the company’s own strategy cycles and asset lifespans.
Finalising material IROs for your report
After scoring your list, the final phase involves refining your data so it is clear, structured, and auditable.
1
Aggregate and group your IROs
A robust identification process can produce hundreds of granular findings. Rather than listing every issue individually, companies should consolidate related findings into broader sustainability themes, following EFRAG’s Materiality Assessment Guidance.
Example
Instead of separately listing risks linked to carbon pricing, transport logistics mandates, and energy taxation, these can be grouped under a broader category such as “Climate Change: Transition Risks.” This improves readability while preserving strategic clarity.
2
Validate through stakeholder engagement
Although stakeholder engagement is not strictly mandatory under the ESRS, EFRAG strongly recommends it as a validation mechanism to strengthen the credibility and completeness of the assessment.
Internal teams
Convene cross-functional reviews involving Sustainability, Finance, Legal, and Risk Management teams to ensure outcomes align with overall corporate strategy.
External stakeholders
Engage investors, consumer advocates, suppliers, and industry experts to benchmark findings against market expectations and identify blind spots.
3
Document your methodology logically
The final test of a materiality assessment is whether it is transparent and auditable. Every included or excluded IRO should be supported by a clearly documented methodology.
The specific scoring criteria, weighting systems, and evaluation ranges applied during the assessment.
The exact numeric or qualitative thresholds used to determine the materiality cut-off point.
The underlying data inputs, assumptions, and stakeholder feedback relied upon throughout the process.
By maintaining this transparent trail, your business ensures a seamless path to compliance, giving assurance providers the exact verification details they require.
CSRD disclosure requirements for IROs
Once your Impacts, Risks, and Opportunities (IROs) have been identified and scored, they must be formally translated into your sustainability statement. Under ESRS 2 (General Disclosures), companies cannot simply publish a random list of green initiatives. You must follow a strict, structured disclosure blueprint governed by three core requirements:
1
ESRS 2 IRO-1: Disclosing the exact process used to identify and assess material IROs.
2
ESRS 2 IRO-2: Presenting the mapping index of which ESRS topical standards are covered.
3
ESRS 2 SBM-3: Explaining how these material IROs interact with your corporate strategy and business model.
Together, these disclosures provide investors, regulators, and assurance providers with a transparent view of your compliance methodology.
1
Materiality assessment process
ESRS 2 IRO-1
Identification architecture
Explain how the initial longlist was built, including reference to EFRAG’s ESRS 1 AR 16 taxonomy and any external frameworks used, such as GRI or SASB.
Risk management integration
Show how sustainability IROs are embedded into the company’s Enterprise Risk Management framework and treated with the same rigour as financial risks.
Data provenance and assumptions
Disclose the data sources used, including internal ESG systems, industry benchmarks, and stakeholder feedback.
Methodological shifts
Identify any changes to scoring thresholds, weighting, or assessment criteria since the previous reporting period, and explain why they were made.
2
Mapping and publishing material issues
ESRS 2 IRO-2 & SBM-3
Cross-reference content index
Provide a clear summary showing which ESRS Environmental, Social, and Governance standards were deemed material.
Disclosure mapping
For every material topic, map it directly to the relevant disclosure requirements and datapoints included in the report.
Strategy alignment
Explain how material IROs influence corporate strategy, financial cash flows, and the future business model.
🚨 The strict rule for omitting climate change
ESRS E1 on climate change carries a particularly high bar for exclusion. If a company concludes that climate change is not material, it cannot simply omit the section.
Under ESRS 2 IRO-2, the company must provide a detailed, data-backed explanation, including forward-looking analysis showing which future operational or environmental conditions would need to hold true for climate change to remain non-material.
Because this justification is heavily scrutinised by external auditors, most European undertakings treat ESRS E1 as a baseline disclosure.
Challenges and best practices for IRO management
setting up a great IRO process looks good on paper, but executing it in the real world is tough. It requires mixing environmental data with financial forecasting - two departments that historically haven't spent a lot of time talking to each other.
If you are running into roadblocks, you aren't alone. Here are the five biggest challenges companies face right now, along with practical ways to solve them.
1
Data is scattered everywhere
⚠️ The problem
Mapping IROs across the value chain requires data from suppliers, HR systems, factory operations, and finance teams. Tracking areas like Scope 3 emissions or supplier working conditions can quickly become fragmented and unreliable.
✓ The solution
Start small and build a structured data diary. Document gaps, use reliable industry averages where necessary, and centralise information into a dedicated sustainability platform instead of relying on disconnected spreadsheets.
2
Everyone wants something different
⚠️ The problem
Investors may focus primarily on financial risk, while employees and communities prioritize environmental and social impacts. Balancing competing expectations makes it difficult to determine what is truly material.
✓ The solution
Run structured stakeholder workshops with internal and external groups. Present findings clearly, facilitate discussion, and document the rationale behind the final priorities selected.
3
Setting boundaries is confusing
⚠️ The problem
The ESRS framework explains what should be assessed, but it does not provide a universal scoring formula. Teams may disagree over whether a risk qualifies as moderate or severe.
✓ The solution
Build a shared glossary before scoring begins. Define what terms like “high impact” or “severe risk” mean in operational or financial terms to ensure consistency across departments.
4
Overlapping regulations and framework fatigue
⚠️ The problem
Companies already reporting under frameworks like GRI, SASB, or TCFD often feel they are duplicating the same work again under CSRD requirements.
✓ The solution
Use EFRAG interoperability guidance to build one centralised reporting structure. By mapping once against core CSRD requirements, companies can often satisfy multiple frameworks simultaneously.
5
Sustainability moves too fast
⚠️ The problem
Climate events, regulations, and consumer expectations evolve rapidly, meaning a materiality assessment completed a year ago can quickly become outdated.
✓ The solution
Treat your IRO register as a living document. Integrate reviews into quarterly risk meetings and reassess material topics whenever major operational or strategic changes occur.
FAQs
What is the difference between an impact and a risk in CSRD?
Simply put, it’s about direction. An impact is an inside-out view - it’s how your company’s actions affect the outside world (like your factory polluting a local river). A risk is an outside-in view - it’s how the outside world threatens your company’s financial health (like a new environmental law forcing you to buy expensive clean-up equipment). Under CSRD, you have to report on both.
Does a company have to report on every single IRO it finds?
No. During your assessment, you will likely find dozens or even hundreds of potential IROs. You are only required to disclose the ones that pass your internal materiality threshold - meaning they have a significant impact on the planet or a meaningful financial effect on your business. You must, however, document why you excluded the minor ones so you can show your auditors.
Who is responsible for signing off on a company’s IRO assessment?
Under the CSRD, the company’s board of directors or administrative management body must formally review and sign off on the double materiality assessment and the finalised list of material IROs. It cannot just be approved by the sustainability team; leadership must demonstrate active oversight.
How often do you need to update your IRO assessment?
You must review and update your IRO assessment annually as part of your regular management report. However, if your business undergoes a major change mid-year - such as a massive merger, entering a completely new geographic market, or a drastic shift in supply chain regulations - you should update your IRO registry dynamically to reflect those new realities.
What happens if our IRO assessment contradicts our financial risk register?
This is a major red flag for external auditors. Your financial risk register and your CSRD sustainability disclosures must be fully aligned. If your IRO assessment claims that climate change poses a severe risk to your operations, but your corporate risk register doesn't mention it, auditors will challenge your methodology. This is why cross-functional teamwork between finance and sustainability is so important.
Do small and medium enterprises (SMEs) have to use the same IRO framework?
While listed SMEs do fall under the scope of CSRD, they use a simplified set of standards known as LSME (Listed SMEs). The core concept of identifying Impacts, Risks, and Opportunities still applies, but the scoring expectations, value chain reporting boundaries, and data points are much less demanding than those for large multinational corporations.
How Greenly can help your company
Streamlined ESG Data Management & Compliance
Greenly streamlines the complex process of ESG data collection, consolidation, and management all in 1 platform.
📥 Import qualitative & quantitative data — platform processes & flags errors
🤖 AI-powered data processing & auto-filling of answers
🔗 Integrated connectivity: map & connect data points across indicators, eliminate redundancy
📂 Centralised platform for all ESG data & supporting docs
⏱️ Track collaborator progress, set reminders & deadlines for compliance
🛡️ Audit-ready traceability: instantly track every change
📊 ESG dashboards to track all key KPIs
🏢 Multi-entity task management & data ingestion at all levels
🧠 AI-powered pre-filling from documentation saves weeks of manual work
🧮 Automatic calculations handle dependencies & speed up consolidation
📈 Multi-entity data collection simplified by mirroring company structure
Strategic ESG Impact & Risk Mitigation
Greenly empowers companies to move beyond reporting to develop strategy, identify risks, and unlock opportunities.
📋 Automated Double Materiality Assessment (DMA) built with CSRD experts
🤖 AI-powered climate risk forecasting integrated into DMA with site-level detail
💰 Translate climate risk into quantified financial opportunities
📍 Location-specific financial risk breakdowns with IPCC-backed data
🔎 Data gap analysis from DMA to improve future reporting
📈 Automated Climate KPI integration
📊 Advanced Materiality Module: benchmarks & specialised add-ons (e.g., CSA)
Tailored & Future-Ready Reporting
Flexible reporting with interoperability across 15+ frameworks.
📝 Custom framework creation with tailored reports
🔀 Interoperability across 10+ frameworks with harmonised database
⚡ Accelerated report creation with AI-powered generation and pre-filling
📄 Auto-generation of complete ESG reports (qualitative & quantitative data)
🛡️ Audit-ready guaranteed reports
💻 Automated ESG report gen incl. XHTML & XBRL for CSRD
📂 Centralised audit trails & attachments per indicator
🤝 Collaborative workflows managing full indicator lifecycle
Expert Guidance & Continuous Support
Comprehensive support & training to empower ESG teams and ensure successful, autonomous reporting.
🧑💼 Dedicated Project Managers & ESG Experts for each framework
📚 Extensive training & resources available on the platform
🤖 AI-powered in-app chatbot (24/7) for instant answers
Close
SourcesShare this article
Subscribe to the CSO Connect Newsletter
We care about your data in our privacy policy.
More articles
View all
Top 10 Carbon Management Software
1 min
Level
In this article, we’ll explore five of the leading carbon management software platforms available today. Whether you're looking to measure your carbon footprint, create actionable decarbonisation plans, or meet regulatory requirements, these tools can help you build a more sustainable future.
