Short-term disruptions—from geopolitical tensions and trade policy shifts to cybersecurity threats—dominate the headlines and boardroom agendas. But companies also face a broader challenge: physical risks from climate change are growing, and companies are increasingly exposed. Although some organizations are starting to act, many are not set up to manage these risks strategically, particularly those related to assets and infrastructure that they rely on but don’t own or operate.
The chief risk officer is best placed to move toward a more quantified and strategic approach to managing physical risks. With a mandate that spans the enterprise, CROs can embed these risks into the company’s overall enterprise risk management framework, translating them into financial terms to support better decision making.
Physical Risk Is Already Material—and Intensifying
In 2025, global direct economic losses from weather- and climate-related events reached approximately $277 billion, according to Gallagher Re, a reinsurance broker. Of the total losses, less than half ($125 billion) were insured. The true economic cost, including indirect impacts such as productivity losses and business interruption, is likely to be significantly higher. As Exhibit 1 shows, average annual losses have roughly doubled in real terms since the early 1990s, owing to the greater frequency and severity of climate events. At the same time, the insurance gap is set to widen as insurers reprice or withdraw from high-risk markets. A 2024 World Economic Forum analysis estimates that, by 2050, physical risks could jeopardize 5% to 25% of EBITDA for companies that don’t adapt, depending on the sector.
These risks are translating into material financial impacts across the enterprise. Within a company’s own operations, revenue losses come from operational disruptions, damage and impairment to assets, and the higher capital and operating costs needed to repair and adapt those assets. Across the entire value chain, from supplier to customer, companies can see losses from volatile input costs and delays and interruptions affecting their operations. Compounding the challenge, they often have little visibility into potential issues at upstream suppliers or downstream distributors.
Although many companies perform advanced risk identification and reporting, they generally look at their own operations, not at the risks arising along their extended value chain. Even where risks are identified, they’re often assessed qualitatively and in silos within functions. Insights are treated in an isolated manner and aren’t translated into financial terms and used for decision making, capital allocation, or strategic planning.
Given the growing threat, companies can do more. Physical risks from climate change are no longer only an operational issue; they are a financial and strategic one, directly affecting capital allocation, performance, and competitiveness.
The CRO Challenge: Rising Expectations, Constrained Capabilities
CROs are increasingly expected to play a central role in addressing physical risks. But they face several structural challenges:
- Inadequate methodologies and data constrain the quantification of financial risk from climate events and the potential impact of risk reduction measures.
- Fragmentation across functions—and limited visibility beyond tier 1 suppliers—prevents a consistent view of material exposure along the full value chain.
- Limited input into investment decisions limits the ability to prioritize and justify resilience measures.
- External expectations are accelerating faster than internal capabilities, with tightening insurance markets and increasing regulatory and investor pressure.
Yet this moment also represents a significant opportunity. The CRO role is evolving, from reporting on risk to enabling the decisions and investments required to manage it. While the CEO and the board retain overall accountability, the CRO is uniquely positioned to drive this transition: breaking down silos, ensuring consistent methodologies, and translating physical risk into financially grounded inputs. As Exhibit 2 shows, the case for action is increasingly clear: resilience measures can generate a sizable ROI. (See “Managing Climate Risks to Roadways in Europe.”)
Managing Climate Risks to Roadways in Europe
A major highway operator in Europe faced physical risks from climate across more than 3,000 kilometers of motorway, including approximately 4,000 bridges, viaducts, and tunnels. Flooding and extreme precipitation were the biggest hazards, and bridges and critical infrastructure were key points of vulnerability. That translated into financial impacts from physical damage to assets (requiring capex), increased maintenance (opex), and traffic disruptions (lost revenue from reduced tolling and other factors). Moreover, disruption to critical infrastructure threatened cascading effects across almost all value chains in the country.
To address these growing risks, the organization developed an adaptation and resilience strategy, including reinforcements for bridges and tunnels, slope stabilization measures, and drainage improvements, to be implemented through the end of the concession period. To finance this strategy, the company raised over €5 billion through sustainable finance instruments, including more than €1 billion from the European Investment Bank. These investments are expected to reduce the financial impact from climate-related events by up to 40%.
Central to this approach, the CRO played a key role in identifying and quantifying climate risks in financial terms, building the case for the resilience strategy and securing investment approval; the CRO now monitors implementation against measurable risk reduction outcomes.
Five Steps for CROs
Building on our recent work supporting CEOs in managing climate risk across value chains, we have developed a set of steps to help CROs translate physical risk into smarter business decisions. (See Exhibit 3.)
1. Identify physical risks. The first step is to understand the company’s vulnerability to physical risks by looking beyond its own operations to the entire value chain in order to identify which products, services, or infrastructure are most critical to maintaining business continuity. The COO and CPO play key roles in this first step, but the CRO is responsible for integrating the results into the company’s existing risk management structure, including the risk taxonomy, registers, and risk appetite, and ensuring that these reflect the distinct nature of the physical risk.
Physical risk assessment must draw on forward-looking climate scenarios rather than historical data, since past experience understates future exposure. Risk appetite thresholds also need to be adjusted (with board approval), particularly for chronic risks that can accumulate into material exposure over time. The CRO should ensure that the methods used to identify risks are systematic, repeatable, and in line with current standards.
2. Quantify risks in financial terms. The CRO can quantify physical risks—both the likelihood of acute events and chronic stressors affecting specific assets or nodes and the financial magnitude of their impact—using the same financial terms and language as those used to quantify other issues, like cyber or legal risk. This ensures that the results are comparable so that leaders can make objective decisions. The company should be able to model how disruptions to physical assets could cascade across the value chain and affect operations using methodologies, planning assumptions, and performance frameworks consistent with how it manages other types of financial risk.
3. Embed physical risk into strategic decisions and capital allocation. The CRO should support the CEO, CFO, and COO to more effectively link resilience planning with capital allocation. The goal is to translate resilience measures into clear investment cases so that they can compete with other uses of capital. This includes evaluating the full set of potential responses—retaining the risk, reducing the company’s exposure through resilience investment, or transferring the risk through insurance—using comparable financial terms (such as net present value, internal rate of return, or avoided losses). (See “New Resources to Quantify the Impact of Resilience Efforts.”)
New Resources to Quantify the Impact of Resilience Efforts
Industry and investor communities are beginning to offer new resources for companies to assess and reduce climate risk. Open Sesame, launched in May 2026, is a joint initiative of the World Business Council for Sustainable Development and the Federation of European Risk Management Associations, with support from BCG. The initiative brings together experts from risk management, insurance, sustainable finance, and banking with the goal of helping companies price in physical risk, reward resilience performance, and finance resilience efforts more efficiently and responsibly.
From the investor side, the Institutional Investors Group on Climate Change launched the Climate Resilience Investment Framework in June 2025 to help investors identify, assess, and manage the financial impact of physical climate risks across their portfolios, with an initial focus on real estate and infrastructure. The framework provides a structured approach to developing climate adaptation and resilience plans. As investors increasingly use CRIF to assess companies’ physical risk management, CROs may find it valuable to align their own risk quantification and reporting with the framework’s expectations.
4. Execute and monitor the resilience strategy. Once the leadership team decides on a resilience strategy, the next step is to execute that plan and monitor results. The CRO is not directly involved in executing the strategy, but he or she can hold the functions accountable and monitor the outcome of resilience investments through quantifiable KPIs. Metrics can be both operational (such as a reduction in asset vulnerability to key hazards) and financial (such as a reduction in expected annual losses).
Those KPIs should be linked to measurable reductions in risk and integrated into regular performance and risk reviews. Integrated monitoring dashboards that consolidate data across functions and geographies into a single view are a powerful tool, giving the CRO the visibility needed to track risk reduction, identify emerging exposures, and inform ongoing business decisions.
The overarching goal is to integrate resilience measures into day-to-day operations—and into business decisions—as opposed to addressing them through a standalone initiative.
5. Report physical risks and resilience as part of overall disclosures. The CRO can disclose physical risk assessments and resilience measures, both proactively in advance of future risks and after a disruption occurs. As physical risks grow, more transparent, comprehensive communication makes companies more accountable and builds trust among the board, external investors, regulators, and other stakeholders. To that end, CROs can ensure that the board and investors see financially grounded risk insights, rather than sustainability disclosures. Information should be consistently quantified in financial terms and useful in supporting decisions across the full spectrum of stakeholders.
As extreme weather events grow in frequency and severity, and as chronic stressors intensify, physical risk is becoming a structural driver of business performance. To meet this challenge, companies can move beyond fragmented, qualitative assessments of owned assets. Instead, CROs can lead companies in taking a more proactive and strategic approach across the full value chain. Embedding physical risks into overall enterprise risk management helps organizations understand the financial impact of risks—and resilience measures—and ensures that business leaders get the information they need to steer performance. Integrated physical risk management across operations and the value chain can become a core differentiator in how companies compete.
