Skip to main content
Governance Authority
Category: Sustainability and ESG

Biodiversity Risk

Also known as: Biodiversity-related risk, Biodiversity-related financial risk
Simply put

Biodiversity risk refers to the potential harm to a company or financial institution arising from the loss of biological diversity and the decline of the ecosystem services that economies depend on. It is generally considered a subset of broader nature-related risks, which extend beyond climate change to include concerns such as water scarcity and ocean acidification. Companies and lenders may face exposure both from the physical effects of biodiversity loss and from changes in policy, markets, or regulation intended to address it.

Formal definition

Biodiversity risk is the exposure of organizations and financial institutions to adverse financial or operational consequences stemming from biodiversity loss and the resulting degradation of ecosystem services. In the sources reviewed, it is typically characterized as encompassing both physical risks (arising directly from ecosystem and species decline) and transition risks (arising from policy, regulatory, market, or reputational shifts in response to biodiversity loss), and is positioned as part of a wider category of nature-related financial risks distinct from, though often analyzed alongside, climate risk. Assessment approaches referenced include tools and indices designed to help entities identify, measure, and act on biodiversity-related exposures at the company, portfolio, or country level; empirical work cited associates biodiversity exposure with firm valuation characteristics. This entry is educational and does not describe a legally mandated risk category; the recognition, measurement methodology, and any disclosure obligations for biodiversity risk vary by jurisdiction, sector, framework, and entity type, and the concept remains an evolving area of practice.

Why it matters

Biodiversity risk matters because many economic activities depend, often invisibly, on ecosystem services, the natural functions that support production, supply chains, and asset values. When biological diversity declines, those services can degrade, exposing companies and their lenders to potential financial and operational harm. Analysis reviewed in the sources positions biodiversity loss within a broader set of nature-related financial risks that extend beyond climate change to include concerns such as water scarcity and ocean acidification, meaning organizations that focus solely on climate may overlook material exposures.

The risk generally has two dimensions that boards and risk functions should consider separately. Physical risk arises directly from ecosystem and species decline that disrupts operations or the resources a business relies on. Transition risk arises from shifts in policy, regulation, markets, or reputation as economies respond to biodiversity loss. Because these drivers differ, the mitigation strategies and the functions responsible for managing them may also differ, and an entity can be exposed to one dimension while relatively insulated from the other.

The financial relevance of these exposures is an active area of empirical study. Research cited in the sources associates biodiversity exposure with firm valuation characteristics, one analysis reports a negative association between biodiversity exposure and the market-to-book ratio, suggesting that value firms may face higher exposure than growth firms. This remains an evolving field: recognition of biodiversity risk, the methodologies used to measure it, and any disclosure obligations vary by jurisdiction, sector, framework, and entity type, and this entry is educational rather than a description of a legally mandated risk category.

Who it's relevant to

Boards and risk committees
Boards and their risk committees may consider whether biodiversity and wider nature-related risks are material to the organization and, where relevant, are captured within existing risk oversight. Their role is generally oversight rather than the operational measurement of exposures, and the extent of attention warranted depends on the entity's sector, geography, and dependence on ecosystem services.
Risk and compliance functions
Risk management functions may be responsible for identifying, measuring, and monitoring biodiversity exposures using tools such as biodiversity risk filters or country-level indices. Because measurement methodologies vary and are still evolving, these functions typically need to document the assumptions and scope of any tool relied upon and to distinguish physical from transition drivers when assessing exposure.
Financial institutions and lenders
Banks, asset managers, and other financial institutions may face biodiversity risk through their financing and investment portfolios, given that borrowers and investees can themselves be exposed. Portfolio- and country-level assessment tools referenced in the sources are designed in part for this audience, and empirical work associates biodiversity exposure with firm valuation characteristics that may be relevant to investment analysis.
Sustainability and ESG teams
Teams responsible for environmental and sustainability matters may lead the practical work of assessing ecosystem-service dependencies and biodiversity exposures, and of tracking developments in frameworks and any emerging disclosure expectations. Whether such disclosures are required depends on jurisdiction, sector, and entity type, so coordination with legal and compliance colleagues is generally advisable.

Inside Biodiversity Risk

Physical (Ecosystem Dependency) Risk
Exposure arising from an entity's reliance on ecosystem services such as pollination, water provision, soil fertility, or raw materials, where degradation or loss of those services can disrupt operations, supply chains, or asset values. This is typically assessed as an operational and financial risk owned by management within the enterprise risk framework.
Transition Risk
Risk stemming from shifts in law, regulation, market preferences, technology, or reputation as economies respond to biodiversity loss. Depending on jurisdiction and sector, this may include emerging disclosure requirements, changing customer expectations, or litigation exposure. Whether specific obligations are binding varies considerably by jurisdiction and entity type.
Systemic and Interconnection Risk
The potential for biodiversity loss to interact with climate change, water scarcity, and broader financial stability, producing cascading effects that are difficult to isolate. Generally addressed at the enterprise level rather than through a single control.
Assessment and Disclosure Frameworks
Voluntary reference tools that some entities use to identify, measure, and report nature-related dependencies and impacts. Such frameworks are generally non-binding guidance, not universally mandatory law, and their applicability depends on jurisdiction, sector, and whether an entity has elected or been required to adopt them.
Inherent versus Residual Biodiversity Risk
Inherent risk reflects exposure before mitigating controls (for example, sourcing from a threatened habitat); residual risk reflects exposure remaining after controls such as sustainable sourcing standards are applied and operating effectively. These are distinct measures and should not be treated interchangeably.
Governance and Accountability Structure
The allocation of responsibility for biodiversity risk: management typically owns identification, measurement, and day-to-day mitigation (first and second lines), assurance functions may provide independent evaluation (third line), and the board or a designated committee generally exercises oversight rather than operational management.

Common questions

Answers to the questions practitioners most commonly ask about Biodiversity Risk.

Is biodiversity risk just another name for climate risk?
No. While the two are related and can be interconnected, they are distinct. Climate risk generally concerns the financial and operational consequences of climate change and the transition to a lower-carbon economy, whereas biodiversity risk concerns an organization's dependencies and impacts on ecosystems, species, and natural capital. A given activity may affect one, the other, or both, and treating them as interchangeable can leave material exposures unassessed. In practice, organizations typically assess each on its own terms while recognizing overlaps, and the appropriate treatment depends on the entity's sector, footprint, and applicable disclosure expectations.
Is managing biodiversity risk a mandatory legal requirement for all organizations?
Not universally. Whether specific biodiversity-related obligations apply depends on jurisdiction, sector, and entity type. In many jurisdictions, biodiversity considerations arise through a combination of binding law (such as environmental permitting or protected-area rules) and non-binding guidance or voluntary frameworks that inform disclosure and management practice. Some regimes are moving toward requiring nature- or biodiversity-related disclosures for certain entities, while others rely on voluntary uptake. Organizations should confirm the specific requirements that apply to them rather than assume a single global standard. This entry is educational and not legal, audit, or compliance advice.
Which function should own biodiversity risk within the organization?
Ownership generally sits with management as part of the first and second lines, while the board or a designated committee typically retains oversight rather than day-to-day operational responsibility. Operational management (first line) usually owns the activities that create dependencies and impacts and the controls that address them; a risk or sustainability function (second line) commonly sets policy, frameworks, and monitoring; and internal audit or another assurance function (third line) may provide independent assurance over the design and operating effectiveness of controls. The precise allocation depends on the organization's structure, materiality, and how it has defined accountabilities.
How does biodiversity risk fit into an existing enterprise risk management framework?
In many organizations, biodiversity risk is integrated as a risk category or driver within the existing enterprise risk management framework rather than managed in isolation. Under frameworks such as COSO ERM or ISO 31000, this typically involves identifying dependencies and impacts, assessing likelihood and impact, distinguishing inherent from residual risk after controls, and evaluating exposures against the organization's stated risk appetite and tolerance. Whether biodiversity warrants a standalone treatment or integration into broader environmental or sustainability risk depends on its materiality to the specific entity and the judgment of those responsible.
What is the difference between a biodiversity dependency and a biodiversity impact when assessing this risk?
The two directions are analytically distinct and both are typically considered. A dependency describes the extent to which an organization relies on ecosystem services, such as pollination, water regulation, or soil stability, so that degradation of nature could disrupt operations or supply chains. An impact describes how the organization's own activities affect ecosystems and species. Assessing only one side gives an incomplete picture: an entity may have low direct impacts but high dependencies, or vice versa. How each is measured and prioritized depends on the entity's activities, data availability, and professional judgment.
What can the board do to exercise effective oversight of biodiversity risk without stepping into management's role?
The board generally exercises oversight by satisfying itself that management has appropriate processes to identify, assess, and respond to material biodiversity risks, rather than by executing those processes itself. In practice this can include reviewing how biodiversity is reflected in the risk framework and risk appetite, questioning management on material dependencies and impacts, considering the adequacy of related disclosures, and confirming that assurance over controls is available where warranted. The appropriate depth of oversight depends on materiality to the organization and how responsibilities are allocated among the board, its committees, and management.

Common misconceptions

Biodiversity risk is simply a subset of climate risk and can be managed through the same processes.
While biodiversity and climate risks are interconnected, they are conceptually distinct. Biodiversity risk centres on dependencies and impacts relating to ecosystems and species, which involve different metrics, drivers, and data challenges. Treating them as identical can leave material dependencies unassessed.
Disclosing biodiversity risk under a recognized framework is a universal legal requirement.
Most biodiversity-related assessment and disclosure frameworks are voluntary guidance rather than binding law. Whether disclosure is mandatory depends on the jurisdiction, sector, listing status, and entity type, and requirements are evolving unevenly across regimes.
Managing biodiversity risk is the board's operational responsibility.
The board generally exercises oversight of how biodiversity risk fits within the entity's risk appetite and governance, while management owns the operational tasks of identifying, measuring, and mitigating the risk. Conflating these blurs the accountability that governance structures are designed to preserve.

Best practices

Distinguish physical, transition, and systemic dimensions of biodiversity risk when scoping assessments, so that dependencies on ecosystem services are not overlooked in favour of only impact-based analysis.
Clarify accountability across the three lines, confirming which functions own identification and mitigation, which provide assurance, and where board or committee oversight sits, rather than defaulting responsibility to any single group.
Assess both inherent and residual biodiversity risk, documenting the controls in place and evaluating both their design and operating effectiveness rather than assuming a mitigant works.
Integrate biodiversity risk into the existing enterprise risk framework and articulate how it relates to risk appetite and tolerance, avoiding treatment as an isolated or purely reputational topic.
Verify jurisdiction- and sector-specific obligations before assuming any disclosure or assessment framework is mandatory, and treat voluntary frameworks as reference tools rather than binding requirements.
Seek qualified legal, audit, or specialist ecological input where materiality, measurement methodology, or regulatory applicability turns on facts and professional judgment, recognizing that this entry is educational and not legal, audit, or compliance advice.