Climate Risk Supply Chain: Identify Hidden Exposures & Build Resilience

A supplier does not have to be in a disaster zone to stop delivering. Flood, drought, wildfire and heat hit the sites your suppliers depend on, and the effect reaches you as a longer lead time or a production stop. This guide covers how to map that exposure across supplier tiers, measure it at site level, keep it under review, and report it under CSRD.

Live data: see how physical climate hazards such as flooding, drought and heat hit specific locations in the Fiegenbaum Atlas climate risk dashboard.

How to Map Climate Risks Across Supplier Tiers

Tier 1 suppliers are the ones you contract with and can name. Tier 2 and sub-tier suppliers are the ones your Tier 1 partners depend on, and that is where most physical exposure sits unseen. Two patterns turn an ordinary hazard into a business risk: single sourcing and site concentration. If four Tier 1 suppliers buy the same input from one Tier 2 site, you have one point of failure.

Energy dependency is the example most maps miss. A Tier 1 assembly supplier looks unexposed, but its aluminium comes from a smelter whose power rests on one hydropower region. A dry summer lifts spot prices, the smelter throttles output, and the cut reaches your line weeks later. The hazard is drought, the exposed asset is in Tier 2, and the damage is measured in lead time. Geopolitical risk compounds the same weak points, because a single-source site under climate stress is also the one with no alternative.

How to Measure Exposure at Supplier Site Level

Exposure is measured per site, not per company. A supplier with twelve plants has twelve risk profiles, and the group average hides all of them. Five steps:

• Get addresses, not company names. Coordinates for every Tier 1 production site, plus the sub-tier sites your Tier 1 partners will disclose.
• Pull hazard data per coordinate. Copernicus C3S and EFFIS across Europe, DWD for German sites, the EEA and the US EPA for regional aggregates, IPCC AR6 WG II for direction of travel.
• Choose the scenario pair. An intermediate and a high emissions pathway, so you see the spread rather than one number. The scenario choice drives the result more than the hazard model does.
• Translate hazard into operations. Expected downtime days, lead time extension, single-source share affected. A flood score with no downtime estimate cannot be prioritised.
• Record the baseline. Write down the assumptions, so next year is a comparison and not a fresh start.

Suppliers hold the data you cannot buy: backup power, water permits, whether the site has flooded before. Long ESG questionnaires fail here, because they land with someone who has no reason to answer. Two operational questions do get answers: which exact site produces our part, and what happened the last time production stopped there.

My position: automated supplier climate scoring is a starting point, not an audit-proof result. Screening tools are useful for narrowing hundreds of suppliers to the few dozen worth a real look. They are not evidence. Any score that ends up in a report needs a named data source, a stated scenario and a documented threshold behind it.

How to Keep Supplier Climate Risk Under Ongoing Review

A one-off assessment ages badly in the parts that change fastest and not at all in the parts everyone re-runs out of habit. Sites move and sourcing shares shift, hazard projections barely budge.

After an event, re-check three things and nothing else: how long the supplier needed to restart, whether the outage matched the modelled downtime, and whether an alternative source was genuinely available. Near misses count too. A supplier that stayed up because a levee held is exposed, not resilient.

Where Value Chain Climate Risk Lands in CSRD and ESRS E1 Reporting

Supplier exposure is a named disclosure, not a side note. Under the ESRS delegated regulation, ESRS E1 asks for a climate resilience analysis covering the value chain and for the anticipated financial effects of physical and transition risks. That is what a site-level supplier assessment produces: which hazard, which site, which scenario, what it costs. Scoping guidance comes from EFRAG.

The EU Taxonomy pulls on the same data. The do no significant harm criterion for climate adaptation in the Climate Delegated Act requires a climate risk and vulnerability assessment for the activity, including relevant parts of the value chain. One assessment serves both.

On materiality, the practical trigger is concentration. A hazard at a supplier carrying a large share of one input, with no qualified alternative, crosses the line even when the absolute exposure looks modest. The reporting obligation itself now applies to companies above 1,000 employees and 450 million euros net turnover, for financial years from 2027.

From Assessment to a Costed Adaptation Plan

A screening result becomes useful when each prioritised risk has a measure, an owner and a number. Cut the ranked list where downtime or single-source share stops being tolerable, and give every remaining item one accountable person in procurement plus a budget line. Measures that earn their cost: dual sourcing for concentrated inputs, contractual restart and notification duties, buffer stock sized to the modelled downtime, and physical protection at the supplier site where a joint investment beats a switch.

Concentration is what makes this affordable. In a climate risk analysis for a southern German dealer group with 18 sites, around 88 percent of the quantified exposure was physical, driven mainly by hail and heavy rain, and hail had already been documented at seven of the 18 locations. The top five sites carried 35 percent of the physical risk. Supplier portfolios have the same shape, so treating every supplier equally is the most reliable way to spend a budget without reducing risk.

Where the exposure sits with a supplier rather than with you, the plan item is a conversation, not a capital request: ask what is already in place, then put the answer in the contract. For tracking measures and evidence, see climate risk management technology.

FAQs